T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:6
- Finding
- Shell Command Injection Through Unrestricted Bash Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 6-25 **Vulnerability Type**: Command injection caused by unrestricted Bash arguments **Risk Level**: High ### Vulnerable Code ```yaml allowed-tools: ["Bash(openant tasks comments *)", "Bash(openant tasks comment *)"] ``` ```bash openant tasks comments <taskId> --json ``` ```bash openant tasks comment <taskId> --content "..." --json ``` ### Technical Analysis The skill grants access to Bash commands with arbitrary trailing arguments through the wildcard patterns `openant tasks comments *` and `openant tasks comment *`. It then instructs the agent to interpolate a task ID and comment content directly into shell command strings. No validation rules are specified for `taskId`, and no shell-safe mechanism is required for passing comment content. If attacker-controlled values are inserted literally, shell metacharacters in a task ID could terminate or extend the intended command. Comment content enclosed in double quotes may also permit command substitution through constructs such as `$()` or break out of the quoted argument when quotes are not safely escaped. The `--json` requirement only affects the OpenAnt command's output format. It does not prevent the shell from evaluating malicious syntax before invoking the CLI. ### Attack Path 1. An attacker supplies a crafted task ID or requests that the agent post attacker-controlled comment content. 2. The agent follows the documented examples and interpolates the supplied value into an allowed Bash command. 3. The crafted value introduces shell syntax, such as a command separator, quote termination, or command substitution. 4. Bash evaluates the injected syntax in addition to the intended `openant` command. 5. The injected command executes with the operating-system privileges and environment access available to the agent process. Exploitation depends on attacker-controlled data being inserted into the shell command without robust validatio ...[truncated 759 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace Bash access with a structured OpenAnt tool that accepts `taskId` and `content` as separate typed arguments without shell interpretation. 2. Validate task IDs against the authoritative OpenAnt identifier format before execution. If the documented format is exhaustive, use a strict allowlist expression such as `^task_[A-Za-z0-9]+$`. 3. Pass comment content through an argument array or another API that does not invoke a shell. Do not concatenate or interpolate it into a command string. 4. If Bash cannot be eliminated, provide a fixed, reviewed wrapper program that: - Accepts values as discrete arguments. - validates task IDs; - invokes `openant` without `sh -c`, `bash -c`, or equivalent shell re-evaluation; - rejects malformed input; and - preserves comment content as data rather than executable syntax. 5. Replace wildcard Bash permissions with narrowly scoped tool permissions that cannot authorize arbitrary trailing shell syntax. 6. Add tests covering semicolons, newlines, quotes, backticks, `$()`, redirection operators, and other shell metacharacters in both task IDs and comment content. ]]>