T09 · Insecure Skill Coding Practices
- Location
SKILL.md:29- Finding
User-Controlled SQL Injection Through Material Slug
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 29–35
Vulnerability Type: SQL injection caused by unsafe string interpolation
Risk Level: MediumVulnerable Code
bash sqlite3 "$DB" \ "SELECT c.front, c.tags FROM cards c JOIN decks d ON d.id = c.deck_id JOIN materials m ON m.id = d.material_id WHERE m.slug = 'SLUG' ORDER BY RANDOM() LIMIT 30;"Technical Analysis
The material slug originates from the user-facing
/algernon interview [SLUG]invocation and is inserted into a quoted SQL statement without parameter binding, escaping, or input validation.If the implementation replaces
SLUGdirectly with user-provided text, an attacker can supply a value containing a single quote and additional SQL syntax. This can terminate the intended string literal, alter the query, or introduce additional statements accepted by the SQLite command-line client.For example, a crafted slug could change the filtering condition to return cards belonging to materials other than the requested one. More destructive payloads could attempt to execute
UPDATE,DELETE, or other SQLite statements against the study database.Attack Path
- An attacker invokes the skill using a crafted material slug containing SQL metacharacters.
- The agent or surrounding implementation substitutes that slug for the
SLUGplaceholder in the documented command. - The resulting SQL is passed to
sqlite3as executable SQL rather than as a bound value. - SQLite interprets the injected syntax as part of the query or as an additional statement.
- The attacker may access unrelated card data or modify the database, subject to the filesystem permissions of the process running the skill.
Impact Assessment
Successful exploitation could compromise the confidentiality and integrity of the local OpenAlgernon study database. An attacker may be able to:
- Read cards and metadata from materials outs ...[truncated 488 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace direct string substitution with a wrapper implemented in a language or library that supports SQLite parameter binding. Bind the slug as a value, for example:
python cursor.execute( """ SELECT c.front, c.tags FROM cards c JOIN decks d ON d.id = c.deck_id JOIN materials m ON m.id = d.material_id WHERE m.slug = ? ORDER BY RANDOM() LIMIT 30 """, (slug,), ) -
Validate the slug before executing the query. If valid slugs are intentionally limited to letters, digits, underscores, and hyphens, enforce an allowlist such as
^[A-Za-z0-9_-]+$. -
Reject values containing quotes, whitespace, semicolons, control characters, or other characters outside the defined slug format. Validation should supplement, not replace, parameter binding.
-
Open the database in read-only mode for interview operations so that a query-processing flaw cannot modify study data.
-
Resolve the supplied slug against a list of existing materials before loading card data.
-
Avoid constructing executable SQL through textual replacement in agent instructions.
-