T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:27- Finding
Command Injection Through Unsanitized Search Query Interpolation
- Content
View full analysis
/tmp/search-injection-proof # ``` After unsafe substitution, the effective shell input could resemble: ```bash curl -s 'http://192.168.199.100:8080/search?q=' ; id > /tmp/search-injection-proof #\&format=json' ``` The shell would execute the injected `id` command independently of `curl`. The same technique could be used for other commands available to the Agent. ### Attack Path 1. An attacker asks the Agent to search for a crafted phrase containing a single quote, shell separators, an operating-system command, and a comment marker. 2. The skill extracts that phrase as the `query` value. 3. The Agent replaces `{{query}}` directly in the documented command without shell-safe encoding. 4. The injected single quote closes the URL string. 5. Shell operators cause the attacker's appended command to execute. 6. The command runs under the operating-system identity and permissions of the Agent process. Exploitation depends on the Agent performing literal template substitution and invoking the resulting text through a shell, which is the execution pattern implied by the skill instruct ...[truncated 644 chars]- Remediation
View remediation