T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:165- Finding
Shell Command Injection Through Unsafely Interpolated User Input
- Content
View full analysis
"" ``` ```markdown | "reject", "no", feedback like "change X to Y" | **Two steps:** `wctl dispatch "4"` then wait 2s then `wctl dispatch ""` | **Important for option 4 (feedback/reject):** This is a two-step process. First dispatch "4" to select the text input option, wait 2 seconds for the text prompt to appear, then dispatch the feedback text. Example: ```bash wctl dispatch abc123 "4" sleep 2 wctl dispatch abc123 "don't modify the database schema" ``` ``` ```bash # Lines 228–232 wctl dispatch-answers --chat-arrows 20 sleep 3 wctl dispatch "" ``` ### Technical Analysis The skill directs the agent to interpolate user-controlled text directly into shell command strings. Placing the text between double quotes does not make this safe: shell metacharacters that terminate the quoted argument can alter command structure, while command substitution such as `$(...)` and backticks remains active inside double quotes. Consequently, the shell may interpret malicious input before `wctl` receives it. The same vulnerable pattern appears in normal message dispatch, rejection feedback, and the “Chat about this” fallback. The issue is especially significant because the skill explicitly instructs the agent to pass the user's original message or feedback through these templates. The statement later in `SKILL.md` that free text is never injected into PTY commands without validation does not provide an actual escaping or validation mechanism and is inconsistent with the documented command templates. ### Attack Path 1. An attacker provides a message or rejection response containing shell syntax, such as a closing quote followed by a command separ ...[truncated 1604 chars]- Remediation
View remediation