T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:28
- Finding
- Unvalidated Slug Enables SQL Injection and Potential Shell Command Injection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:28-30` **Vulnerability Type**: SQL injection and potential shell command injection **Risk Level**: High ### Vulnerable Code ```bash sqlite3 "$DB" "SELECT id, name, local_path FROM materials WHERE slug = 'SLUG';" ``` If no result, stop: "Material 'SLUG' not found. Run `list` to see installed materials." ``` ### Technical Analysis The material slug originates from a user command, but the skill instructs the agent to insert it directly into an SQL statement. No input validation, escaping, or parameter binding is specified. A slug containing a single quote and additional SQL syntax can terminate the intended string literal and alter the query. Depending on the SQLite CLI configuration and available database permissions, this may permit unauthorized database reads, modifications, or additional SQLite operations. There is also a potential shell command injection path if the agent implements the instruction by replacing `SLUG` directly in the displayed shell command. The SQL argument is enclosed in shell double quotes, which do not prevent command substitution through constructs such as `$(...)` or backticks. Thus, a malicious slug could be evaluated by the shell before `sqlite3` receives the query. ### Attack Path 1. An attacker invokes the skill using a maliciously constructed material slug. 2. The agent substitutes the supplied slug into the documented SQLite command. 3. A single quote in the slug terminates the intended SQL string and introduces attacker-controlled SQL syntax. 4. Alternatively, shell substitution syntax embedded in the slug is evaluated while the double-quoted command argument is constructed. 5. The injected SQL accesses or modifies the study database, or the injected shell expression runs a local command with the privileges of the agent process. ### Impact Assessment Successful SQL injection could expose or modify material records and other information in the SQLite databas ...[truncated 402 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not construct SQL by concatenating or substituting user-controlled values. - Use a SQLite library that supports prepared statements and bind the slug as a parameter. - If the SQLite CLI must be used, pass values through a safe parameter mechanism rather than embedding them in SQL text. - Validate slugs against a strict allowlist before database access. For example, permit only expected identifier characters with a rule such as `^[A-Za-z0-9_-]+$`. - Reject slugs containing quotes, whitespace, shell metacharacters, control characters, or path separators. - Avoid invoking a shell for database operations. Execute the database client with a fixed argument array so shell expansion cannot occur. - Apply least-privilege filesystem permissions to the database and run the skill under an account with only the access required for reading installed materials. - Add tests covering SQL metacharacters, command substitutions, backticks, newlines, and malformed Unicode input. ]]>