T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:42- Finding
Command Injection Through Unvalidated YouTube Video ID
- Content
View full analysis
/tmp/yt-transcript.json ``` The instructions direct the Agent to replace `VIDEO_ID` with a value extracted from user input. They accept a direct video ID based only on its length: ```markdown - Direct video ID: `VIDEO_ID` (11 characters) ``` ### Technical Analysis The user-controlled video ID is inserted into a shell command enclosed by double quotes. Shell expansions, including command substitution using `$()`, remain active inside a double-quoted shell string. The JavaScript single quotes surrounding `VIDEO_ID` do not protect against shell interpretation because they are characters inside the outer double-quoted shell argument. Checking only that the input contains 11 characters is insufficient. An 11-character value such as: ```text $(id>/x)#xx ``` causes the shell to execute `id>/x` before Node.js starts. The trailing `#xx` can also alter the resulting JavaScript source. ### Attack Path 1. An attacker submits a crafted 11-character direct video ID containing shell metacharacters or command substitution. 2. The Agent accepts the input because it meets the documented length requirement. 3. The Agent performs textual substitution of the value into the documented shell command. 4. The shell evaluates the injected `$()` expression while constructing the argument passed to Node.js. 5. The injected operating-system command executes with the privileges of the Agent process. ### Impact Assessment Successful exploitation permits arbitrary command execution as the account running the Skill. The hard-coded `/root/claw ...[truncated 439 chars]- Remediation
View remediation