T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:412
- Finding
- Arbitrary Command Execution Through Repository-Controlled Deployment Configuration## Vulnerability Details **File Location**: `SKILL.md`, lines 412–416 **Vulnerability Type**: Shell command injection through unsafe `eval` **Risk Level**: High ```bash # 从 .deploy.yaml 或自动发现获取命令 DEPLOY_CMD=$(get_command "deploy" "$ENV") # 通常是: just deploy $ENV 或 helm upgrade ... echo "[INFO] 执行部署: $DEPLOY_CMD" eval "$DEPLOY_CMD" ``` ### Technical Analysis The deployment command is retrieved from `.deploy.yaml`, a project-controlled configuration file, and passed directly to the shell through `eval`. The Skill does not require validation, an executable allowlist, safe argument parsing, or rejection of shell control syntax before execution. Because `eval` reparses its input as shell code, a crafted deployment value can contain command separators, command substitutions, redirections, pipelines, or other shell constructs. Consequently, a repository contributor who can modify `.deploy.yaml` can turn a normal deployment invocation into arbitrary command execution when a user or Agent runs the Skill. This issue crosses a trust boundary: repository content is treated as executable code while deployment credentials and infrastructure access may be available in the invoking environment. ### Attack Path 1. An attacker gains the ability to contribute to or otherwise modify a repository containing `.deploy.yaml`. 2. The attacker changes the configured deployment command to include a legitimate-looking deployment operation followed by malicious shell syntax. 3. A user or Agent reviews the repository and invokes `/deploy run` for an environment. 4. `get_command "deploy" "$ENV"` reads the attacker-controlled command into `DEPLOY_CMD`. 5. `eval "$DEPLOY_CMD"` reparses the entire value as shell code. 6. The injected command executes with the operating-system identity, environment variables, credentials, network access, and deployment permissions available to the invoking process. ### Impact Assessment Successful exploitation permits arbitrary command execution with th ...[truncated 699 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `eval` and do not execute a configuration value as a shell program. 2. Replace free-form command strings with structured configuration containing: - An allowlisted executable or deployment strategy. - A list of separately parsed arguments. - Explicit environment and component fields. 3. Execute the command using an argument array so shell metacharacters are not interpreted. For example: ```bash cmd=(just deploy "$ENV") "${cmd[@]}" ``` 4. Prefer fixed, strategy-specific implementations for Helm, Kubernetes, Docker Compose, Vercel, and Fly.io rather than arbitrary repository-defined command templates. 5. Validate environment names, component names, file paths, release names, namespaces, and other interpolated values against strict allowlists or conservative character patterns. 6. Reject configuration containing shell control operators, command substitution, redirection, or unexpected executable names. This validation should be defense in depth rather than a substitute for removing `eval`. 7. Display the fully resolved executable and arguments and require explicit user confirmation before production deployment. 8. Treat repository deployment configuration as untrusted during review, especially when the deployment process has access to production credentials.