T09 · Insecure Skill Coding Practices
- Location
scripts/main.py:82- Finding
Shell Command Injection Through Generated WebLogo Instructions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/main.py, lines 82-106
Vulnerability Type: Shell command injection through untrusted heredoc content and unquoted command arguments
Risk Level: MediumVulnerable Code
python def generate_weblogo_commands(self, sequences, output_file="motif_logo.png"): """Generate WebLogo command line instructions.""" # Save sequences to FASTA format fasta_content = [] for i, seq in enumerate(sequences): fasta_content.append(f">seq{i+1}") fasta_content.append(seq) newline = '\n' commands = f"""# Motif Logo Generation Commands # Using WebLogo (https://weblogo.berkeley.edu/) # Step 1: Save sequences to FASTA file cat > sequences.fa << 'EOF' {newline.join(fasta_content)} EOF # Step 2: Convert to alignment format (if needed) # Step 3: Generate logo using WebLogo weblogo -f sequences.fa -o {output_file} -F png \ --title "Sequence Motif" \ --color-scheme chemistry \ --resolution 300 # Alternative: Use seq2logo # seq2logo -f sequences.fa -o {output_file} """ return commandsTechnical Analysis
Sequence values are inserted verbatim into a shell heredoc whose fixed delimiter is
EOF. An attacker-controlled sequence line containing exactlyEOFcan terminate the heredoc early. Subsequent sequence lines then become shell commands when the generated instructions are copied into or executed by a shell.The reusable method also inserts
output_filedirectly into two command lines without shell quoting. Although the current CLI calls the method without forwarding the CLI output path and therefore uses the fixed default, another caller can pass shell metacharacters through this public method argument.The script only prints or saves these instructions and does not execute them automatically. Exploitation therefore requires a user, agent, or downstream automation process to execute ...[truncated 1508 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not generate executable shell scripts from untrusted sequence data.
- Write the FASTA file directly through Python file APIs rather than embedding sequence data in a heredoc.
- Invoke WebLogo with an argument array and
shell=False, for example withsubprocess.run, so shell metacharacters are not interpreted. - Validate sequences against the expected DNA or protein alphabet and reject control characters, embedded newlines, and malformed records.
- Validate output paths separately and enforce an approved output extension and destination directory where appropriate.
- If shell instructions must be generated, use a randomized delimiter that cannot occur in the content and quote every command argument with
shlex.quote(). Direct execution without a shell remains preferable. - Add regression tests using
EOF, command separators, command substitutions, whitespace, and newline-containing values.