T09 · Insecure Skill Coding Practices
- Location
scripts/xeet.sh:17- Finding
JSON Injection Through Unescaped Reply Identifier
- Content
View full analysis
Vulnerability Details
File Location:
scripts/xeet.sh, lines 17–18
Vulnerability Type: JSON injection caused by unsafe string interpolation
Risk Level: Mediumbash if [ -n "$REPLY_TO" ]; then BODY="{\"content\": $(echo "$CONTENT" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read().strip()))'), \"replyTo\": \"$REPLY_TO\"}" fiTechnical Analysis
The script safely serializes
CONTENTwith Python'sjson.dumps(), but inserts the user-controlledREPLY_TOargument directly inside a JSON string. Quotes, backslashes, control characters, or JSON delimiters in that argument are therefore not escaped.A crafted reply identifier can terminate the intended
replyTovalue and inject additional object members or produce malformed JSON. Depending on how the AgentX API handles duplicate keys, an attacker may be able to replace fields such ascontent. This is JSON injection rather than shell command injection: the value remains inside a shell variable and is passed tocurlas one-dargument.Attack Path
- An attacker convinces a user or calling agent to invoke
xeet.shwith attacker-controlled content in the second argument. - The script interpolates that value directly into
BODYwithout JSON serialization. - The crafted value closes the
replyToJSON string and introduces additional properties or invalid syntax. - The resulting body is submitted to
https://agentx.news/api/xeetsusing the victim'sAGENTX_API_KEY. - If the server accepts the manipulated structure, it may publish altered content under the victim's account; otherwise, the malformed request causes the authenticated operation to fail.
Impact Assessment
Exploitation is limited to the authenticated xeet-creation request generated by this script. It may allow alteration of request fields, unintended posting under the victim's AgentX identity, or request-level denial of service. The flaw does not provi ...[truncated 263 chars]
- An attacker convinces a user or calling agent to invoke
- Remediation
View remediation
Remediation Suggestions
Construct the complete request body with a JSON serializer rather than combining serialized and manually interpolated values. Pass both values to Python as arguments, for example:
bash if [ -n "$REPLY_TO" ]; then BODY=$(python3 -c \ 'import json, sys; print(json.dumps({"content": sys.argv[1], "replyTo": sys.argv[2]}))' \ "$CONTENT" "$REPLY_TO") else BODY=$(python3 -c \ 'import json, sys; print(json.dumps({"content": sys.argv[1]}))' \ "$CONTENT") fiAdditionally:
- Validate
REPLY_TOagainst the documented identifier format before sending it. - Reject unexpected control characters and overlong values.
- Use
curl --fail-with-body --show-error --silentso HTTP failures are reliably detected. - Add tests covering quotes, backslashes, newlines, JSON delimiters, and duplicate-key injection attempts.
- Validate