T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:39
- Finding
- Command Injection and Unsafe Temporary File Handling in PDF Processing Workflow<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 39 **Vulnerability Type**: Shell command injection and unsafe temporary file handling **Risk Level**: High ### Vulnerable Code ```markdown | **PDF Files (URL/Local)** | Use `shell` with `curl` to download and `pdftotext` to extract text (e.g., `curl -o t.pdf <URL> && pdftotext t.pdf -`). | ``` ### Technical Analysis The skill directs the agent to insert a user-provided URL into a shell command without requiring shell-safe argument handling, URL validation, quoting, or option termination. If the agent substitutes untrusted input directly into the example, shell metacharacters in the URL may be interpreted as command syntax rather than as part of a URL. A value beginning with `-` could also be interpreted as a `curl` option unless option parsing is explicitly terminated. In addition, the predictable relative filename `t.pdf` can overwrite an existing file and may be exposed to symbolic-link or concurrent-operation races. The vulnerability is exploitable when all of the following conditions hold: 1. An untrusted user controls the PDF URL. 2. The agent follows the documented shell-based workflow. 3. The URL is interpolated into the command rather than passed through a structured process API as a discrete argument. 4. The shell executes the resulting command with the agent's operating-system permissions. ### Attack Path 1. An attacker asks the skill to process a PDF and supplies a URL containing shell metacharacters or command substitution syntax. 2. The agent replaces `<URL>` in the documented example with the attacker-controlled value. 3. The shell parses the injected syntax as one or more additional commands. 4. Those commands execute with the same permissions and environment access as the agent process. 5. The commands may read or modify files available to that account, disrupt the current task, or transmit accessible information over the network. 6. Separately, an attacker with sui ...[truncated 965 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not interpolate user-controlled URLs into shell command strings. 2. Invoke `curl` and `pdftotext` through a structured process API using explicit argument arrays. 3. Insert `--` before the URL to terminate `curl` option parsing. 4. Permit only explicitly approved URL schemes, such as HTTPS, and reject control characters and malformed URLs. 5. Restrict requests to approved remote destinations where possible. Block loopback, link-local, private-network, and cloud-metadata addresses to reduce server-side request forgery risk. 6. Enforce download size, redirect, timeout, and content-type limits. 7. Create a unique private temporary directory and randomly named file for every operation rather than using `t.pdf`. 8. Open temporary files securely, prevent symbolic-link following, and remove temporary artifacts in a guaranteed cleanup step. 9. Run document conversion with least privilege and, where available, inside a sandbox with restricted filesystem and network access. 10. Replace the unsafe example with guidance equivalent to the following pseudocode: ```text temp_dir = create_private_temporary_directory() pdf_path = create_secure_unique_file(temp_dir) run(["curl", "--fail", "--location", "--max-time", TIMEOUT, "--output", pdf_path, "--", validated_https_url]) run(["pdftotext", pdf_path, "-"]) securely_remove(temp_dir) ``` ]]>