T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/solve-captcha.js:81
- Finding
- Shell Command Injection Through Unsanitized Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/solve-captcha.js`, lines 81–82 **Vulnerability Type**: OS command injection **Risk Level**: High ### Vulnerable Code ```js const cmd = `mcporter call minimax-coding-plan.understand_image prompt="${prompt}" image_source="${imagePath}"`; const result = execSync(cmd, { encoding: 'utf-8', timeout: 30000 }); ``` ### Technical Analysis The script constructs a shell command by directly interpolating the user-controlled `prompt` and `imagePath` values. These values are populated from command-line arguments and are not escaped or validated before being passed to `execSync`. Because `execSync` executes the constructed string through a shell, enclosing values in double quotes does not make them safe. An attacker can use quote termination, command substitution, backticks, or other shell syntax to execute additional commands. The `prompt` argument provides a direct exploitation route without needing to satisfy the image existence check applied to `imagePath`. ### Attack Path 1. An attacker persuades a user or automation system to invoke the script with a malicious `--prompt` value. 2. The argument is assigned directly to the `prompt` variable. 3. The value is interpolated into the `cmd` shell-command string. 4. Shell metacharacters or command substitutions embedded in the value are interpreted by the shell. 5. The injected command executes with the permissions of the account running the Skill. For example, a malicious prompt containing a quote breakout or shell command substitution could cause an additional local command to run when the MiniMax request is initiated. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the invoking process. Depending on those privileges, an attacker could: - Read application files, environment variables, tokens, or other credentials accessible to the invoking user. - Modify or delete local files. - Execute additiona ...[truncated 363 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Avoid constructing a shell-command string. Invoke the executable directly and pass each argument separately: ```js const { execFileSync } = require('child_process'); const result = execFileSync( 'mcporter', [ 'call', 'minimax-coding-plan.understand_image', `prompt=${prompt}`, `image_source=${imagePath}` ], { encoding: 'utf-8', timeout: 30000, shell: false } ); ``` Additional hardening should include: 1. Verify that every option requiring a value actually has a following argument. 2. Reject null bytes and unexpected control characters. 3. Resolve the image path with `fs.realpathSync` and verify it is within an explicitly permitted directory. 4. Apply reasonable length limits to prompts and paths. 5. Use a restricted execution account with only the filesystem permissions required for image analysis. 6. Avoid logging sensitive prompts or filesystem paths unless explicitly requested. 7. Add automated tests containing quotes, command substitutions, backticks, semicolons, and newline characters to confirm they are treated only as literal argument data. ]]>