T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:408- Finding
Shell Command Injection Through Direct Placeholder Interpolation
- Content
View full analysis
" \ --duration 10 --aspect-ratio 9:16 --mode pro ``` Related command templates include: ```bash yt-dlp --no-warnings -f best --no-playlist -o "$TMPDIR/%(id)s.%(ext)s" "<视频链接>" ``` ```bash python3 ~/.openclaw/skills/douyin-video-forge/scripts/kling_api.py generate-with-image \ --prompt "<当前段落的可灵Prompt>" \ --image "<上一段最后一帧图片路径>" \ --duration 10 --aspect-ratio 9:16 --mode pro ``` ### Technical Analysis The Skill tells the agent to substitute generated prompts, externally sourced video URLs, and file paths directly into shell command templates. Enclosing a placeholder in double quotes is not sufficient if substitution occurs while constructing a shell command string. Shell metacharacters such as command substitution expressions remain dangerous if they become part of the final command before shell parsing. The prompt is particularly exposed because it may contain data derived from user briefs, public video titles, comments, search results, or other externally controlled content. A malicious value containing a quote followed by shell syntax could terminate the intended argument and introduce another command. The Python CLI itself uses `argparse` safely, but that protection applies only after the shell has parsed the command. It does not mitigate injection in the agent-generated shell command. ### Attack Path 1. An attacker supplies a project brief, reference title, video URL, product description, or other source text containing shell metacharacters. 2. The content is carried into a Kling prompt or substituted into the `yt-dlp` command. 3. The a ...[truncated 1170 chars]- Remediation
View remediation