T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:25
- Finding
- Shell Command Injection Through Unsafely Interpolated Content<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:25` - `references/cron-config.md:28` - `references/cron-config.md:55` - `references/engagement-playbook.md:51-53` **Vulnerability Type**: Shell command injection through direct interpolation of generated or configurable values **Risk Level**: High ### Vulnerable Code `SKILL.md:25`: ```bash xurl --app <app> post "<tweet text>" ``` `references/cron-config.md:28`: ```text Primary: exec → xurl --app <app> post "<tweet>" ``` `references/cron-config.md:55`: ```text 1. Search each keyword: xurl --app <app> search "<keyword>" -n 5 ``` `references/engagement-playbook.md:51-53`: ```text 1. `xurl like <tweet_id>` 2. Write reply (personalised, quality-checked) 3. `xurl reply <tweet_id> "<reply>"` → fallback to browser if fails ``` ### Technical Analysis The Skill constructs shell-style commands by inserting values such as `<app>`, `<tweet text>`, `<keyword>`, `<tweet_id>`, and `<reply>` directly into command strings. Several of these values are generated from brand configuration, model output, user input, or content retrieved from X/Twitter. Wrapping a value in double quotes does not make it safe for shell execution. If the underlying `exec` implementation invokes a command shell, characters such as double quotes, command substitutions, backticks, variable expansions, redirection operators, and command separators may still alter the intended command. For example, generated text containing a closing quote followed by shell syntax could terminate the expected argument and introduce another command. The risk is particularly relevant because reply and posting content may be influenced by external social-media posts. Quality scoring and personalization requirements do not constitute syntactic validation or shell escaping. ### Attack Path 1. An attacker supplies malicious brand configuration, asks the operator to use crafted tweet text, or publishes an X/Twitter post designed to influence a generat ...[truncated 1622 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Avoid shell command construction.** Invoke `xurl` using a process API that accepts an executable and an argument array, for example conceptually: ```text executable: xurl arguments: ["--app", validatedApp, "post", generatedTweet] shell: false ``` 2. **Pass content as a literal argument or through standard input.** Do not concatenate tweets, replies, keywords, usernames, or identifiers into a command string. 3. **Disable shell evaluation explicitly.** Ensure the execution API uses `shell: false` or its platform-equivalent setting. 4. **Validate structured fields with allowlists.** - Restrict application names to an expected set or a conservative pattern. - Require tweet IDs to contain digits only. - Validate usernames against the syntax accepted by X/Twitter. - Enforce documented length limits on tweets, replies, and search terms. 5. **Do not treat quote wrapping as escaping.** If a shell cannot be avoided, use a platform-tested escaping routine for every dynamic argument. Argument-array execution is strongly preferred. 6. **Separate untrusted source content from executable instructions.** Treat social-media posts and user-provided brand material as data only. Do not copy source text into command templates without safe argument handling. 7. **Add adversarial tests.** Test generated content containing quotes, backticks, `$()`, semicolons, pipes, redirections, newlines, and platform-specific metacharacters. Verify that each value reaches `xurl` as one literal argument and cannot invoke another process. 8. **Apply least privilege.** Run the automation under a dedicated account with minimal filesystem access, restricted environment variables, and only the service permissions required for posting and engagement. ]]>