T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:32- Finding
Shell Command Injection Through Unsafe User-Controlled Argument Interpolation
- Content
View full analysis
/deepwiki_ask.py -r -q "" --json ``` ```text python /deepwiki_ask.py -r --structure --json ``` ```text python /deepwiki_ask.py -r --contents --json python /deepwiki_ask.py -r --contents --topic "" --json ``` ### Technical Analysis The Skill instructs an Agent to construct shell commands by inserting user-controlled repository names, questions, and topics directly into command strings. The `` value is not quoted at all. Although the question and topic values are enclosed in double quotes, embedded quotation marks, command substitutions, and other shell metacharacters are not escaped. Consequently, quoting alone does not provide a reliable security boundary. The Python code validates the repository only after process startup. Any shell metacharacters are interpreted before `deepwiki_ask.py` receives the argument, so application-level validation cannot prevent command injection at that stage. The vulnerable behavior depends on the Agent or runtime executing these templates through a command shell. Invocation through a shell-free process API with a separately constructed argument array would not have the same flaw. ### Attack Path 1. An attacker supplies a repository name, question, or topic containing shell control syntax. 2. The Agent extracts that value and substitutes it into one of the command templates from `SKILL.md`. 3. The resulting command is passed to a shell. 4. The shell interprets the injected metacharacters before starting the Python script. 5. The attacker-controlled command runs with the operating-system permissions of the Agent process. ### Impact Assessment Successful exploitation provides arbitrary local command execution ...[truncated 575 chars]- Remediation
View remediation