T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:24- Finding
Shell Command Injection Through Unsanitized Search Query
- Content
View full analysis
" --limit 20 ``` ### Technical Analysis The skill instructs the agent to obtain a user-controlled search term and insert it into a shell command. If the agent performs direct textual substitution before invoking a shell, the double quotes around `""` do not provide adequate protection. An attacker can supply a query containing a closing quotation mark followed by shell operators, command substitutions such as `$()`, or backticks. The shell may then interpret part of the query as a command rather than as one argument to `graph_query.py`. The `${CLAUDE_PLUGIN_ROOT}` expansion is also unquoted. A plugin-root value containing whitespace or shell wildcard characters could cause argument splitting or pathname expansion, although this variable is less directly exposed to the requesting user. Exploitation depends on the agent constructing the displayed command through textual interpolation and executing it via a shell. Invocation through a structured argument array with shell parsing disabled would prevent this vulnerability. ### Attack Path 1. An attacker requests a graph search and supplies a crafted term containing shell metacharacters, such as a quotation mark that terminates the intended query argument followed by a command substitution. 2. The agent replaces `` directly with the attacker-controlled value. 3. The agent submits the resulting command to a shell. 4. The shell parses the injected syntax separately from the intended `--query` argument. 5. The injected operating-system command executes with the same identity and permissions as the agent process. ### Impact Assessment Successful exploitation permits arbitrary command execution within the privileges of the agent or automat ...[truncated 512 chars]- Remediation
View remediation