T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:8
- Finding
- Shell Command Injection Through User-Controlled Problem Statements## Vulnerability Details **File Location**: `SKILL.md`, lines 8–16; duplicated at lines 38–47 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```markdown ## Usage When a complex coding task is requested, formulate a concise, descriptive problem statement and run the `mini` CLI using a bash tool. ```bash mini --yolo "Fix the authentication logic in /src/auth.py to ensure tokens expire after 3600 seconds" Rules Autonomy: Always use the --yolo flag so the agent runs autonomously without waiting for user input. Formatting: Escape double quotes inside the problem statement if necessary. ``` ### Technical Analysis The skill instructs the agent to place a problem statement derived from a user's request into a Bash command. Its only stated sanitization measure is escaping double quotation marks. Escaping double quotes does not make untrusted content safe inside a double-quoted Bash argument. Bash continues to evaluate command substitutions using `$(...)` and backticks inside double quotes. Depending on how the command is assembled, newlines, backslashes, and other shell syntax may introduce additional parsing risks. For example, if an attacker supplies a problem statement containing `$(arbitrary-command)`, constructing the documented command as shell text can cause Bash to execute that command before invoking `mini`. The same unsafe guidance appears in the installation-copy content later in the file. ### Attack Path 1. An attacker places shell substitution syntax in a coding request, issue description, or other text used to formulate the problem statement. 2. The agent follows the skill and interpolates that text into `mini --yolo "..."`. 3. The command is passed to a Bash tool as shell source. 4. Bash evaluates embedded `$(...)` or backtick substitution despite the surrounding double quotes. 5. The injected command executes with the filesystem, network, environment, and cre ...[truncated 599 chars]
- Remediation
- ## Remediation Suggestions - Do not construct a shell command by interpolating the problem statement into command text. - Invoke `mini` through a structured process API with an argument array, equivalent to `["mini", "--yolo", problemStatement]`, without `shell=true`. - If the available execution interface only accepts shell source, apply a well-tested POSIX shell-quoting routine to the complete argument rather than merely escaping double quotes. - Reject or safely handle control characters, command substitutions, backticks, and unexpected newlines as defense in depth. - Keep user-controlled issue and repository content separate from executable instructions. - Add tests covering payloads containing `$(...)`, backticks, quotation marks, backslashes, semicolons, and newlines. - Correct both copies of the instructions so the installed version does not preserve the vulnerable pattern.