T09 · Insecure Skill Coding Practices
- Location
SKILL.md:412- Finding
Arbitrary Command Execution Through Repository-Controlled Deployment Configuration
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 412–416
Vulnerability Type: Shell command injection through unsafeeval
Risk Level: Highbash # 从 .deploy.yaml 或自动发现获取命令 DEPLOY_CMD=$(get_command "deploy" "$ENV") # 通常是: just deploy $ENV 或 helm upgrade ... echo "[INFO] 执行部署: $DEPLOY_CMD" eval "$DEPLOY_CMD"Technical Analysis
The deployment command is retrieved from
.deploy.yaml, a project-controlled configuration file, and passed directly to the shell througheval. The Skill does not require validation, an executable allowlist, safe argument parsing, or rejection of shell control syntax before execution.Because
evalreparses its input as shell code, a crafted deployment value can contain command separators, command substitutions, redirections, pipelines, or other shell constructs. Consequently, a repository contributor who can modify.deploy.yamlcan turn a normal deployment invocation into arbitrary command execution when a user or Agent runs the Skill.This issue crosses a trust boundary: repository content is treated as executable code while deployment credentials and infrastructure access may be available in the invoking environment.
Attack Path
- An attacker gains the ability to contribute to or otherwise modify a repository containing
.deploy.yaml. - The attacker changes the configured deployment command to include a legitimate-looking deployment operation followed by malicious shell syntax.
- A user or Agent reviews the repository and invokes
/deploy runfor an environment. get_command "deploy" "$ENV"reads the attacker-controlled command intoDEPLOY_CMD.eval "$DEPLOY_CMD"reparses the entire value as shell code.- The injected command executes with the operating-system identity, environment variables, credentials, network access, and deployment permissions available to the invoking process.
Impact Assessment
Successful exploitation permits arbitrary command execution with th ...[truncated 699 chars]
- An attacker gains the ability to contribute to or otherwise modify a repository containing
- Remediation
View remediation
Remediation Suggestions
- Remove
evaland do not execute a configuration value as a shell program. - Replace free-form command strings with structured configuration containing:
- An allowlisted executable or deployment strategy.
- A list of separately parsed arguments.
- Explicit environment and component fields.
- Execute the command using an argument array so shell metacharacters are not interpreted. For example:
bash cmd=(just deploy "$ENV") "${cmd[@]}" - Prefer fixed, strategy-specific implementations for Helm, Kubernetes, Docker Compose, Vercel, and Fly.io rather than arbitrary repository-defined command templates.
- Validate environment names, component names, file paths, release names, namespaces, and other interpolated values against strict allowlists or conservative character patterns.
- Reject configuration containing shell control operators, command substitution, redirection, or unexpected executable names. This validation should be defense in depth rather than a substitute for removing
eval. - Display the fully resolved executable and arguments and require explicit user confirmation before production deployment.
- Treat repository deployment configuration as untrusted during review, especially when the deployment process has access to production credentials.
- Remove