T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:43
- Finding
- Shell Command Injection Through User-Controlled Event Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 43-49 **Vulnerability Type**: Shell command injection caused by unsafe command construction **Risk Level**: High ### Vulnerable Code ```bash source ~/.env/.env cd /Users/viki/Projects/projects/marketing-bull/babenchuk-com CLOUDFLARE_API_TOKEN="$CF_API_TOKEN" \ CLOUDFLARE_ACCOUNT_ID="$CF_ACCOUNT_ID" \ npx wrangler d1 execute mb-events --remote \ --command "INSERT INTO events (name, address, date_start, date_end, location, rsvp_contact, rsvp_to, register_url, tags) VALUES ('...', ...);" ``` ### Technical Analysis The Skill instructs the Agent to incorporate event information received through messages, CSV files, or lists into a SQL statement embedded directly inside a double-quoted shell argument. The only documented escaping rule is to double SQL single quotes. That may address basic SQL string termination, but it does not address shell metacharacters interpreted while the generated command is parsed. If the Agent places an event field containing a double quote, command substitution, backticks, or other shell syntax directly into the command text, the value can escape the intended `--command` argument and cause arbitrary local commands to run. This is particularly dangerous because the command is executed in a process that has access to Cloudflare credentials loaded immediately beforehand. ### Attack Path 1. An attacker supplies a crafted event name, address, URL, or another event field through a message or CSV file. 2. The Agent follows the Skill and converts that value into an inline SQL statement. 3. The crafted value contains shell syntax that terminates or alters the double-quoted `--command` argument. 4. The shell evaluates the injected command when the generated Wrangler invocation is executed. 5. The injected process runs with the permissions of the Agent's operating-system account and may inherit or access the loaded Cloudflare credentials. 6. The attacker can consequently ...[truncated 582 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not construct shell commands by interpolating event data into command strings. - Generate SQL using a dedicated parser or serializer that safely handles every field. - Write bulk SQL to a securely created randomized temporary file with owner-only permissions. - Invoke Wrangler through an argument-array process API without an intermediate shell. - Apply allowlist validation appropriate to each field: - Parse and normalize dates using a date library. - Validate registration URLs against an explicit URL scheme policy. - Reject control characters from textual fields. - Enforce reasonable field-length limits. - Prefer parameterized database operations if supported by the selected Cloudflare interface. - Keep credentials out of the generated SQL and avoid logging complete commands containing sensitive environment data. - Add adversarial tests covering quotes, double quotes, backticks, command substitution syntax, newlines, and malformed CSV fields. ]]>