T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:6- Finding
Shell Command Injection Through Unescaped User-Controlled Prompt
- Content
View full analysis
` parameter. 4. If the user specifies an image save path, use the `--output=` parameter. 5. By default, execute the command in headless mode in the background: `npx ts-node /Users/pengjianfang/skills/doubao-web-image/scripts/main.ts "user's prompt" [optional parameters]`. ``` ### Technical Analysis The Skill instructs an AI Agent to interpolate a prompt derived from user input directly into a quoted shell command. It does not require argument-array execution, shell escaping, or validation of the prompt and optional output path. Double quotes alone are not a sufficient security boundary. If an Agent invokes this command through a shell, a malicious prompt containing a closing quote, command substitution, or other shell syntax could alter the resulting command. For example, input structurally resembling `" ; attacker-command ; echo "` could terminate the intended prompt argument and introduce another command. The absolute script path is also hardcoded to `/Users/pengjianfang/skills/doubao-web-image/scripts/main.ts`, which lies outside the audited artifact. If that location contains a different or attacker-controlled file, the Agent could execute code that was not included in this review. ### Attack Path 1. An attacker submits an image-generation request containing shell metacharacters or command-substitution syntax. 2. The Agent extracts the attacker-controlled text as the image prompt. 3. Following `SKILL.md`, the Agent inserts the prompt between double quotes in the documented command template. 4. The Agent execute ...[truncated 916 chars]- Remediation
View remediation