T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:142- Finding
Unvalidated table identifier enables SQL injection in generated templates
- Content
View full analysis
= CURRENT_DATE - INTERVAL '90 days' GROUP BY $group_by ORDER BY $group_by; -- KPI card query SELECT $(split_csv "$METRICS" | while read -r m; do metric_formula "$m"; done | sed 's/^/ /' | paste -sd ',\n' -) FROM $TABLE WHERE event_date >= CURRENT_DATE - INTERVAL '30 days'; EOF_SQL } ``` ### Technical Analysis The `--table` option is accepted by `parse_opts` and stored in `TABLE`, but `cmd_sql` inserts that value directly after both `FROM` clauses. Metrics and dimensions are passed through `slugify`, while the table identifier receives neither validation nor identifier quoting. Because this command generates text rather than directly connecting to a database, invoking the skill alone does not execute the injected SQL. The vulnerability becomes exploitable when a user, automation pipeline, or BI platform executes the generated template. SQL delimiters, comments, or additional clauses supplied through `--table` can then change the intended query structure. ### Attack Path 1. An attacker influences the value passed to `--table`, such as through an untrusted dashboard request or automated prompt. 2. The attacker supplies a value containing SQL s ...[truncated 872 chars]- Remediation
View remediation