T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:279- Finding
Shell Command Injection Through an Unvalidated Authorization Code
- Content
View full analysis
``` The surrounding instructions require the authorization code supplied by the user to be passed directly to `bind-wallet`. They also prohibit local format validation and require the complete command string to be executed through the `exec` tool. ### Technical Analysis The authorization code is attacker-controlled input. It is inserted into a shell command without quoting, escaping, or validation. If `exec` interprets the documented command through a shell, metacharacters such as command separators, substitutions, or redirections are evaluated by the shell rather than passed exclusively as part of the `-c` argument. The instruction to let the CLI validate the value does not mitigate this issue because shell parsing occurs before `alipay-bot` receives its arguments. ### Attack Path 1. An attacker sends a message formatted as an authorization-code response. 2. The supplied value contains shell syntax, such as a benign proof-of-concept value equivalent to `123; id`. 3. The Skill extracts the entire value and constructs the documented command: ```bash alipay-bot bind-wallet -c 123; id ``` 4. The Agent passes the complete string to a shell-backed `exec` tool. 5. The shell runs `alipay-bot` and then executes the injected command. 6. More harmful commands could subsequently read or modify files, access process credentials, or initiate network connections. ### Impact Assessment Successful exploitation provides arbitrary command execution with the operating-system privileges of the Agent process. The attacker could potentially: - Read files accessible to the Agent account. - Modify project or user files. - Access credentials available to the process. - Execute additional local programs. - Initiate unauthorized outbound network requests ...[truncated 257 chars]- Remediation
View remediation