T09 · Insecure Skill Coding Practices
Error
- Location
scripts/aitubiao-cli.sh:64- Finding
Persistent Shell Command Injection Through Executable Credential Storage
- Content
View full analysis
&2 echo "Please configure credentials first. See SKILL.md for setup instructions." >&2 exit 1 fi source "$CREDENTIALS_FILE" ``` The credential-writing function accepts any value beginning with `sk_v1_` and interpolates it directly into an executable shell file: ```bash cmd_auth() { local api_key="${1:-}" if [[ -z "$api_key" ]]; then echo "Error: API Key required. Usage: aitubiao-cli.sh auth " >&2 echo "Get one at: https://app.aitubiao.com/setting/api-keys?utm_source=skill_skill-clawhub&channel=skill-clawhub" >&2 exit 4 fi if [[ ! "$api_key" =~ ^sk_v1_ ]]; then echo "Error: Invalid API Key format (must start with sk_v1_)" >&2 echo "Get a valid key at: https://app.aitubiao.com/setting/api-keys?utm_source=skill_skill-clawhub&channel=skill-clawhub" >&2 exit 4 fi mkdir -p "$(dirname "$CREDENTIALS_FILE")" cat > "$CREDENTIALS_FILE" << EOF API_KEY=$api_key BASE_URL=https://api.aitubiao.com CHANNEL=skill-clawhub EOF chmod 600 "$CREDENTIALS_FILE" ``` ### Technical Analysis The API-key validation is not anchored at the end of the value and only checks that the supplied argument starts with `sk_v1_`. It does not restrict the remaining characters to the expected key alphabet or reject shell metacharacters and embedded newline characters. The value is subsequently interpolated into `~/.aitubiao/credentials`. That file is treated as executable shell syntax by: ```bash source "$CREDENTIALS_FILE" ``` Consequently, the credential file is not merely configuration data. Any shell syntax inserted into it can be evaluated in the co ...[truncated 1885 chars]- Remediation
View remediation