T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:65
- Finding
- Shell Command Injection Through Untrusted Pull Request Metadata<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 65-112 **Vulnerability Type**: Shell command injection through unsafe command construction **Risk Level**: High ### Vulnerable Code ```bash gh pr create --title "<type>(<scope>): <description>" --body "$(cat <<'EOF' ## Summary <1-3 sentence overview of what this PR does and why> ## Changes <Categorized bullet list of changes> ### Added - <new features or capabilities> ### Changed - <modifications to existing functionality> ### Fixed - <bug fixes> ### Removed - <deprecated or removed functionality> ## Motivation <Why were these changes needed? What problem does this solve?> ## Testing <How was this tested?> - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [ ] Manual testing performed ### Manual Testing Steps <If applicable, steps to manually verify the changes> ## Breaking Changes <If any, describe what breaks and migration path. Remove section if none.> ## Related Issues <Link to related issues. Remove section if none.> - Closes #<issue_number> - Related to #<issue_number> ## Checklist - [ ] Code follows project style guidelines - [ ] Self-review completed - [ ] Tests pass locally - [ ] Linting passes - [ ] Documentation updated (if needed) EOF )" ``` The values used to replace these placeholders are derived from repository-controlled sources collected earlier in the Skill: ```bash git log --oneline main..HEAD git log --format="### %s%n%n%b" main..HEAD git diff --stat main..HEAD git diff main..HEAD ``` ### Technical Analysis The Skill instructs the agent to derive a pull request title and body from commit messages, branch changes, and file diffs, and then place that generated content directly into shell source code. Commit subjects, commit bodies, branch-related context, file contents, and diffs can be controlled by an untrusted repository contributor. The template does not require shell-safe encoding or validation before this content is embe ...[truncated 2885 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Do not generate executable shell source containing repository-derived text.** Treat commit messages, branch names, diffs, comments, and file contents as untrusted data. 2. **Write the pull request body to a file through a non-shell file-writing API**, and pass it to GitHub CLI using: ```bash gh pr create --title "$SAFE_TITLE" --body-file "$BODY_FILE" ``` Prefer a structured process-execution API that accepts an argument array rather than a command string. 3. **Pass the title as a discrete process argument.** Do not substitute generated text into a command template that is subsequently parsed by a shell. For example, invoke the equivalent of: ```text ["gh", "pr", "create", "--title", generatedTitle, "--body-file", bodyPath] ``` 4. **If a shell is unavoidable**, store generated values as data in safely initialized variables and avoid `eval`, nested shell parsing, or dynamically generated scripts. Apply rigorous shell escaping appropriate to the exact shell, although structured argument execution remains preferable. 5. **Replace the heredoc-based body construction.** If a heredoc must be retained, use a randomly generated delimiter that is verified not to occur in the body. This is still less robust than writing through a file API. 6. **Add explicit validation before execution.** Reject control characters and detect heredoc delimiter collisions. Validation should be defense in depth rather than the primary protection. 7. **Require confirmation of the exact title and body before creating the pull request**, especially when the repository or branch is not fully trusted. 8. **Execute with least privilege.** Limit the GitHub token to the minimum required repository permissions and avoid exposing unrelated secrets or privileged credentials to the Skill runtime. ]]>