T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:103- Finding
Shell Command Injection Through Direct Query Interpolation
- Content
View full analysis
" [result-count] ``` The documented execution process directs an agent to place a user-derived search query inside a shell command. The examples use the same direct interpolation pattern. ### Technical Analysis Double quotes are not a complete security boundary for untrusted shell input. If an agent constructs this command as text and passes it to a shell, an attacker can provide a query containing a closing quote followed by shell operators or command substitution syntax. The JavaScript implementation obtains the query through `process.argv` and does not itself evaluate it as code. The vulnerability exists at the invocation boundary described by the skill instructions: an agent may concatenate attacker-controlled text into a command string before `search.js` starts. An illustrative malicious query could terminate the quoted argument and append another shell command. The precise payload depends on the operating system and shell used by the agent. ### Attack Path 1. An attacker submits a search request containing quote-breaking shell syntax. 2. The agent extracts that request as the search query. 3. Following `SKILL.md`, the agent embeds the query directly into the documented command string. 4. The agent invokes the command through a shell. 5. The shell interprets the injected metacharacters rather than treating the entire query as one inert argument. 6. The injected command runs with the same operating-system identity and permissions as the agent process. ### Impact Assessment Successful exploitation can execute arbitrary local commands with the agent's privileges. Depending on those privileges, an attacker could read or modify accessible files, access environment variables and crede ...[truncated 240 chars]- Remediation
View remediation