T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:20
- Finding
- Unsafe Search-Term Interpolation Enables SQL and Shell Command Injection## Vulnerability Details **File Location**: `SKILL.md`, lines 20-27 **Vulnerability Type**: SQL injection and shell command injection **Risk Level**: High ### Vulnerable Code ```bash Run a PostgreSQL query against the `knowledge_base` table using the `bash` tool: ```bash psql "$DATABASE_URL" \ -c "SELECT content::text, source, data_type FROM knowledge_base WHERE content::text ILIKE '%SEARCH_TERM%' LIMIT 5;" ``` Replace `SEARCH_TERM` with the relevant keyword(s). ``` ### Technical Analysis The Skill directs the Agent to replace `SEARCH_TERM` directly inside a SQL string that is itself embedded in a double-quoted shell argument. No prepared statement, SQL-literal escaping, shell-safe argument handling, or input validation is required. This creates two injection boundaries: 1. **SQL injection:** A search term containing a single quote can terminate the `ILIKE` pattern and append arbitrary SQL. For example, a value shaped like `' OR 1=1 --` can change the predicate, comment out the documented result limit, and retrieve unrelated records. 2. **Shell command injection:** Because the complete SQL statement is enclosed in shell double quotes, shell expansions such as command substitution can be interpreted before `psql` receives the SQL. If the Agent constructs and executes the documented command with an attacker-controlled term such as `$(...)`, the shell may execute the substituted command locally. The instruction prohibiting `INSERT`, `UPDATE`, and `DELETE` is advisory. It does not prevent injected statements if the database account referenced by `DATABASE_URL` has write or administrative privileges. ### Attack Path 1. An attacker asks the Agent to search for a crafted keyword. 2. The Agent follows the Skill and replaces `SEARCH_TERM` in the documented command. 3. For SQL injection, the crafted term closes the SQL literal and adds a new condition or stacked statement. 4. For shell injection, the crafted term ...[truncated 1039 chars]
- Remediation
- ## Remediation Suggestions - Do not interpolate user-provided terms into shell source or SQL text. - Prefer an application database library with prepared statements and bound parameters. - If `psql` must be used, pass the search term as a separately quoted variable and use PostgreSQL/psql literal quoting rather than textual replacement. - Construct process arguments as an argument array without invoking a shell. - Reject control characters and unexpected syntax as defense in depth, but do not treat validation as a substitute for parameterization. - Configure `DATABASE_URL` with a dedicated database role that has only the minimum required `SELECT` permissions. - Set transaction-level read-only enforcement, statement timeouts, and row limits at the database layer. - Restrict access to approved views instead of exposing base tables. - Add tests using single quotes, SQL comments, semicolons, command substitutions, backticks, newlines, and other shell metacharacters.