T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:40
- Finding
- Shell Command Injection Through Unsafe Research Query Interpolation## Vulnerability Details **File Location**: `SKILL.md`, lines 40–44 **Vulnerability Type**: Command injection through unsafe shell-string construction **Risk Level**: High **Vulnerable Code**: ```python # Best: run in a sub-agent (main session stays responsive) sessions_spawn task:"research-tool 'your query here'" # Or via exec — NEVER set timeout, use yieldMs to background: exec command:"research-tool 'your query'" yieldMs:5000 ``` ### Technical Analysis The documented invocation pattern embeds an arbitrary natural-language research query inside a command string delimited by single quotes. It does not require argument-safe invocation, escaping, or input validation. If an agent substitutes attacker-controlled text directly for `your query`, a query containing a single quote can terminate the intended argument. Shell metacharacters can then introduce an additional command. For example, a payload shaped like `' ; attacker_command ; #` could alter the resulting command when the execution interface invokes a shell. The same trust-boundary issue applies to the `sessions_spawn` example because the task is represented as a command-like string. Exploitability there depends on how the spawned agent parses and executes that task. ### Attack Path 1. An attacker supplies or influences a research query processed by the Skill. 2. The agent follows the documented example and inserts the query directly into `research-tool '...'`. 3. The query contains a single quote followed by shell control syntax. 4. The quote closes the intended query argument, and the remaining syntax is interpreted as a separate shell command. 5. The injected command executes with the privileges and environment of the agent process. ### Impact Assessment Successful exploitation could permit arbitrary command execution under the account running the agent. The attacker could read or modify files accessible to that account, invoke local programs, make network ...[truncated 428 chars]
- Remediation
- ## Remediation Suggestions - Pass the executable and user query as separate argument-array elements rather than constructing a shell command string. - Use an execution API that bypasses shell interpretation. - If the platform only accepts command strings, apply robust, platform-specific shell escaping rather than manually surrounding input with quotes. - Treat all research queries as untrusted input and reject control characters or unsupported shell syntax as defense in depth. - Prefer standard input for long or untrusted prompts, such as invoking `research-tool --stdin` through an argument-safe API and supplying the query through a dedicated stdin field. - Add regression tests using quotes, command substitutions, newlines, semicolons, pipes, and redirection operators. - Document explicitly that queries must never be concatenated into executable shell strings.