T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sellersprite_mcp.py:17- Finding
OS Command Injection Through Shell-Based MCP Invocation
- Content
View full analysis
Dict[str, Any]: """Execute an mcporter command and return parsed JSON.""" try: result = subprocess.run( command, shell=True, capture_output=True, encoding='utf-8', errors='replace', timeout=30 ) ``` ```python def _call(self, tool: str, **kwargs) -> Dict[str, Any]: """Invoke an MCP tool.""" args = " ".join([f'{k}: "{v}"' if isinstance(v, str) else f'{k}: {v}' for k, v in kwargs.items()]) cmd = f'mcporter call {self.server}.{tool} {args}' return run_mcporter(cmd) ``` ### Technical Analysis `SellerSpriteMCP._call()` constructs a command by directly interpolating tool arguments into a string. `run_mcporter()` then executes that string using `subprocess.run(..., shell=True)`. String values are only surrounded by double quotes and are not escaped for the operating-system shell. Double quotes do not neutralize shell command substitution, and an attacker can also introduce a closing quote followed by shell metacharacters. Consequently, attacker-controlled values can alter the command interpreted by the shell instead of remaining data passed to `mcporter`. The vulnerable sink is reachable from normal Skill input. In particular, `TrafficAnalysisV2.comprehensive_analysis()` accepts a user-provided keyword and passes it through `_auto_discover_competitors()` and `CachedAPILayer.call()` to `SellerSpriteMCP._call()`. ### Attack Path 1. An attacker supplies a category keyword containing shell syntax, such as command substitution or a quote followed by a shell operator. 2. `TrafficAnalysisV2.comprehensive_analysis()` receives the malicious keyword. 3. `_auto_discover_competitors()` passes it to the `competitor_loo ...[truncated 1252 chars]- Remediation
View remediation