T09 · Insecure Skill Coding Practices
- Location
scripts/list-workflows.sh:5- Finding
Arbitrary Command Execution Through Arithmetic Injection in the Limit Argument
- Content
View full analysis
Vulnerability Details
File Location:
scripts/list-workflows.sh, lines 5-19
Vulnerability Type: Shell arithmetic injection
Risk Level: HighVulnerable Code
bash JSON_ONLY=false LIMIT=20 while [[ $# -gt 0 ]]; do case $1 in --json) JSON_ONLY=true; shift ;; --limit) LIMIT="$2"; shift 2 ;; *) shift ;; esac done if [ "$JSON_ONLY" = true ]; then muapi workflow list --output-json else muapi workflow list | head -n $((LIMIT + 5)) fiTechnical Analysis
The value supplied through
--limitis stored without verifying that it is an integer. It is subsequently evaluated inside the Bash arithmetic expansion$((LIMIT + 5)).Bash arithmetic expressions can recursively interpret variable contents as arithmetic syntax. Crafted expressions can reference array subscripts or other arithmetic constructs containing command substitutions. As a result, an attacker-controlled
LIMITvalue can cause shell commands to execute while the arithmetic expression is being evaluated.Merely quoting the initial assignment does not make the later arithmetic evaluation safe. The input must be restricted to an expected numeric format before it enters an arithmetic context.
Attack Path
- An attacker gains influence over arguments passed to
list-workflows.sh, such as through an automated agent request, wrapper command, or untrusted job parameter. - The attacker supplies a malicious arithmetic expression as the value of
--limit. - Line 11 stores that expression verbatim in
LIMIT. - Line 19 evaluates the value through
$((LIMIT + 5)). - Embedded shell evaluation in the malicious arithmetic expression executes with the privileges of the account running the Skill.
Impact Assessment
Successful exploitation can provide arbitrary command execution under the Skill runner's operating-system account. The attacker could read or alter files acces ...[truncated 373 chars]
- An attacker gains influence over arguments passed to
- Remediation
View remediation
Remediation Suggestions
Require
--limitto contain only decimal digits before using it in an arithmetic expression:bash if ! [[ "$LIMIT" =~ ^[0-9]+$ ]]; then echo "Error: --limit must be a non-negative integer" >&2 exit 1 fi if (( LIMIT > 1000 )); then echo "Error: --limit exceeds the permitted maximum" >&2 exit 1 fi muapi workflow list | head -n "$((10#$LIMIT + 5))"The
10#prefix explicitly treats the validated value as base 10. Quoting the finalheadargument also prevents unintended word splitting.Additional hardening should include:
- Reject missing values before reading
$2. - Reject unknown command-line options instead of silently ignoring them.
- Add automated negative tests using arithmetic expressions, command substitutions, whitespace, signs, and oversized values.
- Apply numeric validation to every script option that is expected to represent a number.
- Reject missing values before reading