T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:29- Finding
Command and Argument Injection Through Unvalidated Git References
- Content
View full analysis
# Get full commit info git log -1 --format="Hash: %H%nAuthor: %an%nDate: %ad%nMessage: %s%n" # Chronological diff (older..newer) git diff .. # Diff stat git diff --stat .. # Show files changed git diff --name-only .. ``` The skill also permits several forms of user-controlled references: ```markdown Accept various formats: - Full SHA: `abc123def456...` - Short SHA: `abc123d` (at least 7 chars) - Branch names (if they point to commits) - HEAD references like `HEAD~5` ``` ### Technical Analysis The skill instructs an agent to place user-provided commit references directly into Git command lines. It does not require strict input validation, shell escaping, argument-array execution, rejection of option-like values, or canonicalization to verified object IDs. If an implementation invokes these commands through a shell, a supplied reference containing shell metacharacters can terminate or alter the intended Git command and append another command. For example, a value shaped like `HEAD; attacker-command` could cause the shell to execute `attacker-command` after the Git operation when substituted without quoting. Even if no shell is involved, attacker-controlled values beginning with `-` may be interpreted as command-line options rather than revisions in command forms that do not establish a safe option boundary. Supporting arbitrary branch names and revision expressions expands the accepted input beyond hexadecimal object IDs and increases the parsing attack surface. The Markdown file itself does not contain an executable payload. Exploitation depends on an ag ...[truncated 1383 chars]- Remediation
View remediation
^{commit}' ``` - Capture the resulting full hexadecimal object ID. - Use only the verified full IDs in subsequent `git log` and `git diff` operations. 4. **Establish safe argument boundaries** - Use `--` where the specific Git subcommand supports it. - Do not rely on quoting alone as a substitute for structured process invocation and validation. 5. **Constrain execution** - Run the skill with least privilege in the intended repository. - Avoid exposing unrelated credentials, sensitive directories, or unnecessary network access to the process. 6. **Add adversarial tests** - Test values containing semicolons, command substitutions, spaces, newlines, leading hyphens, malformed revisions, and ambiguous references. - Verify that malicious values are rejected and never interpreted by a shell or as unintended Git options. ]]>