T09 · Insecure Skill Coding Practices
Error
- Location
skills.md:35- Finding
Shell Command Injection Through Unsafely Interpolated Reminder Content
- Content
View full analysis
" \ --session isolated \ --at 2m \ --agent main \ --message "" \ --deliver \ --channel discord \ --to channel: \ --delete-after-run ``` ### Technical Analysis The skill directs the agent to invoke `moltbot cron` through the shell-backed `exec` tool and interpolate reminder content into the `--message` argument. The reminder text originates from the user and is therefore untrusted. Wrapping the value in double quotes does not prevent shell evaluation. Command substitutions using `$(...)` or backticks are evaluated inside double-quoted strings. Embedded quotation marks may also terminate the intended argument and permit the addition of shell operators or commands. The instructions do not require shell-safe escaping, structured argument passing, input validation, or any other mechanism that ensures the message is treated exclusively as literal data. Other dynamic values in the command, including the job name and channel identifier, should also be considered untrusted unless obtained from a trusted context and strictly validated. ### Attack Path 1. An attacker submits a scheduling request containing shell syntax in the reminder text, such as `$(malicious-command)`. 2. The agent places that text into the documented `--message ""` command template. 3. The agent sends the resulting command to the shell-backed `exec` tool. 4. The shell evaluates the command substitution before starting `moltbot`. 5. The injected command executes with the operating-system privileges and environment available to the agent process. 6. After executing the injected command, the shell may still invoke `moltbot`, potentially concealing the compromise behi ...[truncated 1009 chars]- Remediation
View remediation