T09 · Insecure Skill Coding Practices
- Location
SKILL.md:17- Finding
Potential Shell Command Injection Through Unvalidated Analysis Parameters
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 17–19
Vulnerability Type: Shell command injection
Risk Level: HighComplete Code Snippet:
markdown ### 1. 构建分析命令 根据用户指令构建命令，固定使用 `run_cli.py`： - **基础模式**：`./venv/bin/python3 run_cli.py -t {标的编码} -a {analysts} -l {language} -n` - **示例**：如果用户要求“启动报告引擎分析 AAPL，只要基本面”，则执行 `./venv/bin/python3 run_cli.py -t AAPL -a fundamental -l Chinese -n`；若未明确指定分析师组合，则默认传入 `-a social,news,market,fundamental`。Technical Analysis
The Skill instructs the agent to interpolate user-derived ticker, analyst, and language values directly into a textual command. It does not require allowlist validation, safe quoting, metacharacter rejection, or execution through a structured argument vector.
If an implementation follows this instruction by passing the assembled string to a shell, shell operators within any substituted value may be interpreted as command syntax rather than data. The flaw is conditional on shell-based execution; direct process invocation with separately supplied arguments would substantially reduce this risk.
Attack Path
- An attacker invokes the Skill using an explicitly recognized trigger phrase.
- The attacker supplies a ticker, language, or analyst value containing shell metacharacters and an additional command.
- The agent substitutes that value into the documented command template.
- The generated command is executed through a shell without validation or safe argument separation.
- The shell interprets the injected operators and executes the attacker-supplied command with the privileges of the agent process.
Impact Assessment
Successful exploitation could provide arbitrary command execution under the account running the Skill. The attacker could read or modify files accessible to that account, access locally available application credentials or tokens, tamper with generated reports, or use the process's permitted network acce ...[truncated 192 chars]
- Remediation
View remediation
Remediation Suggestions
- Validate ticker symbols with a restrictive allowlist appropriate to supported markets, such as
^[A-Z][A-Z0-9.-]{0,9}$, after normalizing case. - Restrict the analyst parameter to an explicit set such as
social,news,market, andfundamental; parse combinations as individual values and reject unknown entries. - Restrict the language parameter to explicitly supported language names or codes.
- Invoke Python through a process API using a structured argument array, for example:
python subprocess.run( [ "./venv/bin/python3", "run_cli.py", "-t", ticker, "-a", ",".join(analysts), "-l", language, "-n", ], check=True, shell=False, ) - Never concatenate user-controlled values into a command passed to
sh,bash,shell=True,os.system, or an equivalent shell interpreter. - Reject control characters and shell metacharacters as defense in depth, log validation failures, and add tests covering separators, substitutions, redirections, quoting, and newline injection.
- Run the analysis process with least privilege and limit its filesystem, credential, and network access to reduce impact if validation is bypassed.
- Validate ticker symbols with a restrictive allowlist appropriate to supported markets, such as