T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:39- Finding
Command Injection and Unsafe Temporary File Handling in PDF Processing Workflow
- Content
View full analysis
&& pdftotext t.pdf -`). | ``` ### Technical Analysis The skill directs the agent to insert a user-provided URL into a shell command without requiring shell-safe argument handling, URL validation, quoting, or option termination. If the agent substitutes untrusted input directly into the example, shell metacharacters in the URL may be interpreted as command syntax rather than as part of a URL. A value beginning with `-` could also be interpreted as a `curl` option unless option parsing is explicitly terminated. In addition, the predictable relative filename `t.pdf` can overwrite an existing file and may be exposed to symbolic-link or concurrent-operation races. The vulnerability is exploitable when all of the following conditions hold: 1. An untrusted user controls the PDF URL. 2. The agent follows the documented shell-based workflow. 3. The URL is interpolated into the command rather than passed through a structured process API as a discrete argument. 4. The shell executes the resulting command with the agent's operating-system permissions. ### Attack Path 1. An attacker asks the skill to process a PDF and supplies a URL containing shell metacharacters or command substitution syntax. 2. The agent replaces `` in the documented example with the attacker-controlled value. 3. The shell parses the injected syntax as one or more additional commands. 4. Those commands execute with the same permissions and environment access as the agent process. 5. The commands may read or modify files available to that account, disrupt the current task, or transmit accessible information over the network. 6. Separately, an attacker with sui ...[truncated 965 chars]- Remediation
View remediation