T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:6
- Finding
- Shell Command Injection Through Unescaped PubMed Search Input<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 6-10 **Vulnerability Type**: Shell command injection caused by unsafe input interpolation **Risk Level**: High ### Vulnerable Code ```bash ## Quick Search Search for papers on a topic: ```bash curl -s "https://eutils.ncbi.nlm.nih.gov/entrez/eutils/esearch.fcgi?db=pubmed&term=YOUR_QUERY&retmax=10&retmode=json&sort=relevance" ``` ``` ### Technical Analysis The Skill instructs an agent to replace `YOUR_QUERY` directly within a double-quoted shell command. It does not require shell-safe argument handling or URL encoding. If untrusted search input contains a double quote, shell control operators, and a comment marker, it can terminate the quoted URL and introduce another command. For example, substituting the following query: ```text cancer"; id; # ``` would produce a command structurally equivalent to: ```bash curl -s "https://eutils.ncbi.nlm.nih.gov/entrez/eutils/esearch.fcgi?db=pubmed&term=cancer"; id; #&retmax=10&retmode=json&sort=relevance" ``` The shell would execute `id` separately from `curl`. An attacker could replace `id` with another command. The absence of URL encoding also permits malformed requests and query-parameter manipulation, although command injection is the primary security risk. The package contains no executable implementation, so exploitation depends on an agent following this documented shell pattern and inserting attacker-controlled input verbatim. ### Attack Path 1. An attacker supplies a crafted medical literature query to an agent using this Skill. 2. The query includes a double quote to terminate the URL string, followed by a shell command and a comment marker. 3. The agent replaces `YOUR_QUERY` directly with the crafted input as instructed. 4. The agent executes the resulting command through a shell. 5. The injected command runs with the operating-system privileges and environment of the agent process. ### Impact Assessment Successful exploitation ...[truncated 678 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Avoid constructing shell commands by inserting user-controlled text into command strings. Use an HTTP client or agent networking tool that accepts query parameters as structured data. If `curl` must be used, place the query in a separate variable and pass it through `--data-urlencode`: ```bash QUERY='user-supplied search term' curl --silent --get \ 'https://eutils.ncbi.nlm.nih.gov/entrez/eutils/esearch.fcgi' \ --data-urlencode 'db=pubmed' \ --data-urlencode "term=${QUERY}" \ --data-urlencode 'retmax=10' \ --data-urlencode 'retmode=json' \ --data-urlencode 'sort=relevance' ``` Additional hardening should include: 1. Explicitly prohibit evaluating or concatenating user input into a shell command. 2. Prefer direct process invocation with an argument array rather than invoking a shell. 3. URL-encode all externally supplied query values. 4. Keep the NCBI host and API path fixed rather than accepting a user-controlled destination. 5. Validate reasonable query length and reject control characters where they are unnecessary. 6. Run the agent with least privilege and without unrelated credentials in its environment. 7. Add tests covering quotes, semicolons, command substitutions, newlines, and other shell metacharacters. ]]>