T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:93
- Finding
- Command and Python Code Injection Through Unsafe File-Path Interpolation## Vulnerability Details **File Location**: `SKILL.md`, line 93 **Vulnerability Type**: Command injection caused by unsafe interpolation of user-controlled file paths **Risk Level**: High **Vulnerable code snippet**: ```bash python -c "from PIL import Image, ImageOps; im=ImageOps.exif_transpose(Image.open('原图')); im.thumbnail((2048,2048)); im.convert('RGB').save('压缩后.jpg', quality=85)" npx --yes sharp-cli -i 原图 -o 压缩后.jpg resize 2048 ``` ### Technical Analysis The Skill instructs the Agent to replace the placeholder input and output paths directly inside shell commands. In the Python variant, the input path is interpolated into a Python string literal embedded within the `python -c` argument. A path containing a single quote or other Python syntax can terminate the string and inject additional Python statements. The `sharp-cli` fallback passes paths as unquoted shell arguments. Filenames containing shell metacharacters, command substitutions, whitespace, or redirection operators can modify the command when interpreted by a shell. A filename beginning with a hyphen may also be interpreted as a command-line option. The vulnerable compression workflow is triggered when an input image exceeds 10 MB. Product images are user-supplied inputs, so their local filenames cannot safely be assumed to contain only trusted characters. ### Attack Path 1. An attacker supplies an image larger than 10 MB so that the documented compression workflow is activated. 2. The image is stored under a crafted filename containing Python syntax or shell metacharacters. 3. The Agent substitutes that path into the documented `python -c` or `npx` command. 4. The shell parses the resulting command, or Python parses the modified inline program. 5. Attacker-controlled code executes under the operating-system account running the Agent. ### Impact Assessment Successful exploitation can execute arbitrary commands with the Agent process's user privil ...[truncated 486 chars]
- Remediation
- ## Remediation Suggestions - Never interpolate file paths into an inline Python program. - Use a fixed Python script and pass input and output paths through `sys.argv`. - Invoke subprocesses through an argument array without a shell, such as Python's `subprocess.run([...], shell=False, check=True)`. - If shell execution is unavoidable, apply robust shell quoting to every path and place `--` before positional filenames where the target utility supports it. - Generate the output path internally in a controlled temporary directory rather than deriving executable command text from user input. - Validate that the input is a regular image file and reject paths containing null bytes or paths outside approved working directories. - Avoid relying on filename extensions alone; decode and validate the image before processing it. - Add tests using filenames containing quotes, spaces, semicolons, command substitutions, leading hyphens, and newline characters.