T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:27
- Finding
- Command Injection Through Unsanitized Search Query Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27–31 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```markdown 2\. 执行命令：   ```bash   curl -s 'http://192.168.199.100:8080/search?q={{query}}\&format=json' ``` ### Technical Analysis The skill directs the Agent to extract a user-controlled search query and interpolate it into a shell command. Although the URL is enclosed in single quotes, the instructions do not validate or escape single-quote characters in `{{query}}`. If template substitution occurs before shell execution, an attacker can supply a query containing a single quote to terminate the quoted URL, followed by shell control operators and an arbitrary command. A trailing comment marker can suppress the remainder of the generated command. A representative malicious query is: ```text ' ; id > /tmp/search-injection-proof # ``` After unsafe substitution, the effective shell input could resemble: ```bash curl -s 'http://192.168.199.100:8080/search?q=' ; id > /tmp/search-injection-proof #\&format=json' ``` The shell would execute the injected `id` command independently of `curl`. The same technique could be used for other commands available to the Agent. ### Attack Path 1. An attacker asks the Agent to search for a crafted phrase containing a single quote, shell separators, an operating-system command, and a comment marker. 2. The skill extracts that phrase as the `query` value. 3. The Agent replaces `{{query}}` directly in the documented command without shell-safe encoding. 4. The injected single quote closes the URL string. 5. Shell operators cause the attacker's appended command to execute. 6. The command runs under the operating-system identity and permissions of the Agent process. Exploitation depends on the Agent performing literal template substitution and invoking the resulting text through a shell, which is the execution pattern implied by the skill instruct ...[truncated 644 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Avoid constructing shell source by interpolating user-controlled input. 1. Prefer a structured HTTP client or Agent HTTP tool that accepts the URL and query parameters as separate values. 2. If `curl` is required, store the query as data rather than embedding it into the command text: ```bash curl --silent --get \ --data-urlencode "q=$QUERY" \ --data "format=json" \ "http://192.168.199.100:8080/search" ``` 3. Invoke the process through an argument-array API rather than through `sh -c`, `bash -c`, or another shell interpreter. 4. Ensure `$QUERY` is supplied as a separate process argument or environment value and is never concatenated into generated shell code. 5. Add tests using hostile input containing single quotes, semicolons, command substitutions, newlines, and comment markers. 6. Use HTTPS for the search endpoint if supported to protect queries and responses from local-network interception or modification. ]]>