T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:239- Finding
Shell Command Injection Through User-Controlled Message Interpolation
- Content
View full analysis
"`. ``` The same unsafe command-construction pattern also appears in the usage examples at `SKILL.md:51-60` and `SKILL.md:122-154`. ### Technical Analysis The Skill instructs the agent to insert a natural-language instruction into a quoted shell command. If the execution environment constructs this command through textual interpolation and invokes a shell, the user controls content within `""`. Double quotes are not a complete shell-escaping mechanism. A malicious instruction can contain command substitutions such as `$(command)` or backticks. It can also contain a quote that terminates the argument, followed by shell metacharacters and an additional command. The Python implementation uses `argparse` and does not itself invoke a shell. The vulnerability exists at the boundary described by `SKILL.md`: unsafe construction of the command before Python starts. Exploitation therefore requires the hosting agent or tool to execute the documented command through a shell rather than passing an argument array directly. ### Attack Path 1. An attacker submits a natural-language request containing shell syntax, such as a command substitution or a quote followed by a shell command. 2. The agent follows the mandatory Skill instruction and substitutes that request into: ```bash python skills/axelrod/scripts/axelrod_chat.py --message "" ``` 3. A shell parses the constructed string before launching Python. 4. The injected shell expression executes with the same operating-system privileges and environment as the agent. 5. The attacker may use those privileges to read accessible files, alter the ...[truncated 613 chars]- Remediation
View remediation