T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-pack.sh:25- Finding
Command Injection Through Unvalidated Arithmetic Input
- Content
View full analysis
${#PROMPTS[@]} ? ${#PROMPTS[@]} : NUM_IMAGES)) ``` ### Technical Analysis The value supplied through `--num` is stored without validating that it is a decimal integer. It is subsequently evaluated inside a Bash arithmetic expansion. Bash arithmetic expansion treats variable values as arithmetic expressions rather than strictly as numeric strings. Arithmetic expressions can trigger recursive variable and array-subscript evaluation. A crafted value containing an array reference with a command substitution can therefore cause Bash to execute an operating-system command while evaluating `LIMIT`. Quoting the value when assigning it to `NUM_IMAGES` does not prevent this issue because the dangerous interpretation occurs later, during arithmetic evaluation. ### Attack Path 1. An attacker supplies a crafted value for the requested image count. 2. An agent or user passes that value to the documented `--num` option. 3. The argument parser stores the complete value in `NUM_IMAGES`. 4. Line 190 evaluates `NUM_IMAGES` as part of a Bash arithmetic expression. 5. Bash processes attacker-controlled arithmetic syntax, including any command substitution reachable through recursive array-subscript evaluation. 6. The injected command executes with the operating-system privileges and environment of the skill process. A representative malicious input would use an arithmetic array subscript containing a command substitution, rather than a legitimate integer. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the skill. Depending on that account's permissions, an attacker could: - Read or modify files accessible to the agent. - Access credent ...[truncated 500 chars]- Remediation
View remediation
&2 exit 1 fi if (( 10#$NUM_IMAGES > 100 )); then echo "Error: --num must not exceed 100." >&2 exit 1 fi NUM_IMAGES=$((10#$NUM_IMAGES)) ``` The `10#` prefix forces decimal interpretation and avoids unintended octal handling. A conservative upper bound also limits resource consumption. Additional hardening should include: - Rejecting missing option values instead of blindly reading `$2`. - Enabling strict shell behavior where compatible: ```bash set -euo pipefail ``` - Using a dedicated argument parser or validation function for every parameter. - Running the script with the minimum filesystem and network privileges required. - Adding regression tests with nonnumeric, negative, oversized, and arithmetic-expression inputs. ]]>