T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:67- Finding
Shell Command Injection Through Interpolated User-Controlled Research Topics
- Content
View full analysis
" \ --report-file /tmp/report.md \ --papers-json /tmp/papers.json ``` A similar pattern is used for the search query at `SKILL.md`, line 35: ```bash python3 {baseDir}/scripts/search_literature.py "" > /tmp/papers.json ``` ### Technical Analysis The Skill instructs the Agent to insert the original user question directly into a double-quoted shell command. Double quotes do not neutralize shell command substitution, and embedded quotation marks can terminate the intended argument. If the Agent constructs and executes this command through a shell, a malicious topic containing syntax such as command substitution can cause additional commands to execute. This risk is not inherent to literature searching or report storage. It results from constructing shell command text with untrusted data instead of passing the topic as an isolated process argument. Exploitation depends on the host Agent following the documented workflow and invoking the generated command through a shell. The vulnerable instruction explicitly directs the Agent toward that execution pattern. ### Attack Path 1. An attacker supplies a crafted research question containing shell syntax, such as a command substitution expression. 2. The Agent follows the Skill instructions and places the original question inside the `--topic` argument. 3. The Agent submits the resulting command to a shell. 4. The shell evaluates the attacker-controlled syntax before invoking `save_research.py`. 5. The injected command executes with the same operating-system permissions as the Agent process. The search command can expose the same attack path if an attacker-controlled or insufficiently sanitized query is inserted into the doc ...[truncated 599 chars]- Remediation
View remediation