T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:239
- Finding
- Shell Command Injection Through User-Controlled Message Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:239` **Vulnerability Type**: Shell command injection at the documented CLI invocation boundary **Risk Level**: Medium ### Vulnerable Code ```markdown - **scripts/axelrod_chat.py** — CLI client. Always invoke with `python skills/axelrod/scripts/axelrod_chat.py --message "<instruction>"`. ``` The same unsafe command-construction pattern also appears in the usage examples at `SKILL.md:51-60` and `SKILL.md:122-154`. ### Technical Analysis The Skill instructs the agent to insert a natural-language instruction into a quoted shell command. If the execution environment constructs this command through textual interpolation and invokes a shell, the user controls content within `"<instruction>"`. Double quotes are not a complete shell-escaping mechanism. A malicious instruction can contain command substitutions such as `$(command)` or backticks. It can also contain a quote that terminates the argument, followed by shell metacharacters and an additional command. The Python implementation uses `argparse` and does not itself invoke a shell. The vulnerability exists at the boundary described by `SKILL.md`: unsafe construction of the command before Python starts. Exploitation therefore requires the hosting agent or tool to execute the documented command through a shell rather than passing an argument array directly. ### Attack Path 1. An attacker submits a natural-language request containing shell syntax, such as a command substitution or a quote followed by a shell command. 2. The agent follows the mandatory Skill instruction and substitutes that request into: ```bash python skills/axelrod/scripts/axelrod_chat.py --message "<instruction>" ``` 3. A shell parses the constructed string before launching Python. 4. The injected shell expression executes with the same operating-system privileges and environment as the agent. 5. The attacker may use those privileges to read accessible files, alter the ...[truncated 613 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Never concatenate or interpolate user-controlled messages into a shell command. 2. Invoke the script without a shell and pass each argument as a distinct array element: ```python subprocess.run( [ sys.executable, "skills/axelrod/scripts/axelrod_chat.py", "--message", user_message, ], shell=False, check=False, ) ``` 3. Update `SKILL.md` to explicitly require structured argument passing and prohibit `shell=True`, `bash -c`, `sh -c`, or equivalent textual command execution. 4. If the hosting framework only supports shell command strings, apply robust platform-specific argument quoting rather than relying on double quotes. 5. Add tests using messages containing quotes, semicolons, backticks, newlines, and command substitutions to verify that all content reaches `argparse` as one literal argument. 6. Limit the runtime account's filesystem, credential, and network access so that any future command-injection flaw has reduced impact. ]]>