T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:205- Finding
Shell Command Injection Through Unescaped ACP Fallback Parameters
- Content
View full analysis
" --mode now ``` ```text exec: cd && acpx claude exec "" ``` ### Technical Analysis The Skill instructs an agent to insert a project path, generated prompt, and completion summary directly into shell command strings. These values can include task-controlled or repository-controlled text, but the documented commands do not require validation, argument-safe process invocation, or platform-appropriate escaping. Double quotes do not provide adequate protection when untrusted input may contain quote characters, command substitutions, shell metacharacters, or newlines. For example, a malicious value containing a closing quote followed by a shell command could terminate the intended argument and introduce another command. Command substitution syntax may also be evaluated inside double-quoted strings on common POSIX shells. The `cd && ...` construction additionally embeds the working directory into shell syntax instead of supplying it through the execution API's dedicated working-directory option. Consequently, both the path and prompt can alter the command's structure. ### Attack Path 1. An attacker supplies crafted task content, causes attacker-controlled repository content to be included in the ACP prompt, or influences the project path or generated completion summary. 2. The agent substitutes that value into ``, ``, or ``. 3. The fallback is executed through a command shell as documented. 4. Shell syntax in the substituted value terminates or modifies the intended argument. 5. The shell executes the injected command with the same operating-system privileges and environment access as the agent process. A representative mali ...[truncated 1058 chars]
- Remediation
View remediation