T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/viral-search.js:75
- Finding
- Shell Command Injection Through the X Search Query<![CDATA[ ## Vulnerability Details **File Location**: `scripts/viral-search.js`, lines 75-79 **Vulnerability Type**: OS command injection through shell interpolation **Risk Level**: High ### Vulnerable Code ```javascript const raw = execSync(`bird search "${searchQuery.replace(/"/g, '\\"')}" -n ${fetchCount} --json`, { encoding: 'utf8', timeout: 30000, stdio: ['pipe', 'pipe', 'pipe'], }); ``` ### Technical Analysis The user-controlled search query is interpolated into a command string executed by `execSync`. Escaping double quotes alone does not prevent shell interpretation inside a double-quoted argument. For example, shell command substitution constructs such as `$(command)` and backticks remain active inside double quotes. Consequently, an attacker who can influence the query can cause the shell to run an additional local command before invoking `bird`. The vulnerability is present in the normal query search path. The fixed trending queries do not introduce the same direct user-controlled input. ### Attack Path 1. An attacker supplies a malicious query containing a shell command-substitution expression. 2. Argument parsing stores that value in `query`. 3. `searchX` appends search operators to the value and stores the result in `searchQuery`. 4. The code escapes only double-quote characters. 5. The resulting value is inserted into a command string passed to `execSync`. 6. The operating-system shell evaluates command substitution within the double-quoted search argument. 7. The injected command executes with the privileges and environment of the user running the Skill. ### Impact Assessment Successful exploitation provides arbitrary command execution under the Agent user's operating-system account. An attacker could read or modify files accessible to that user, access environment variables and local configuration, steal API credentials or social-media sessions, invoke installed tools, or perform network requests. The vulnerability does not in ...[truncated 136 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace shell-based `execSync` with `execFileSync` or `spawnSync`. - Pass every command-line argument in an argument array so no shell parses the query. - Explicitly disable shell execution. - Validate numeric options such as `fetchCount` before passing them to the child process. - Apply reasonable query length limits and reject control characters. A safer implementation would follow this pattern: ```javascript const { execFileSync } = require('child_process'); const raw = execFileSync( 'bird', ['search', searchQuery, '-n', String(fetchCount), '--json'], { encoding: 'utf8', timeout: 30000, stdio: ['pipe', 'pipe', 'pipe'], shell: false, } ); ``` Escaping input is not an adequate substitute for avoiding the shell. ]]>