T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:82- Finding
Command and Code Injection Through Unsanitized Book Names and Download URLs
- Content
View full analysis
" \ -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" \ -H "Referer: https://z701.com/" \ --max-time 600 ``` ```python import zipfile, os outdir = '书名' os.makedirs(outdir, exist_ok=True) with zipfile.ZipFile('书名.zip', 'r') as z: for info in z.infolist(): try: name = info.filename.encode('cp437').decode('gbk') except: name = info.filename basename = os.path.basename(name) if not basename: continue ext = os.path.splitext(basename)[1].lower() if ext in ('.epub', '.azw3', '.mobi', '.pdf', '.txt'): outpath = os.path.join(outdir, basename) data = z.read(info.filename) with open(outpath, 'wb') as f: f.write(data) print(f'Extracted: {outpath} ({len(data)} bytes)') print('Done!') ``` ```bash rm 书名.zip ``` ### Technical Analysis The skill instructs the agent to substitute a user-provided book name and a remotely obtained download URL directly into executable shell and Python templates. It does not require validation, escaping, canonicalization, or shell-free process execution. Double quotes do not make arbitrary input safe when the input itself can contain a quote, command substitution, a newline, or other shell syntax. The cleanup command is even less constrained because its filename is unquoted. Similarly, inserting a book name into a single-quoted Python literal can terminate the literal and introduce attacker-controlled Python statements. The download URL is obtained from a third-party API response. If that source is compromised or returns a maliciously constructed value, direct textual interpolation into the `curl ...[truncated 1857 chars]- Remediation
View remediation