T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/api_cost_tracker.py:357- Finding
Unescaped Attacker-Controlled Model Names Enable Terminal and Markdown Output Injection
- Content
View full analysis
8} {format_tokens(stats['input_tokens']):>8} " f"{format_tokens(stats['output_tokens']):>8} {format_cost(stats['cost']):>10}") ``` ```python for i, e in enumerate(sorted_entries, 1): ts = e.timestamp.strftime("%m-%d %H:%M") if hasattr(e.timestamp, 'strftime') else str(e.timestamp)[:16] model = normalize_model_name(e.model)[:20] print(f" {i:>3}. {ts} {model:<20} {format_tokens(e.input_tokens):>6}in " f"{format_tokens(e.output_tokens):>6}out {format_cost(e.cost or 0)}") ``` ```python for key, stats in groups.items(): print(f"| {key} | {stats['count']} | {format_tokens(stats['input_tokens'])} | " f"{format_tokens(stats['output_tokens'])} | {format_cost(stats['cost'])} |") ``` ### Technical Analysis Model names and aggregation keys originate from user-supplied JSON or CSV usage files. The parsers retain these strings, and the terminal and Markdown output functions interpolate them directly into reports without context-specific encoding or validation. For terminal output, an attacker can include control characters such as carriage returns, newlines, ANSI control sequences, or OSC sequences in a model name. These characters can alter terminal presentation, overwrite report content, forge additional rows, hide warnings, or create deceptive hyperlinks. Some OSC effects, such as clipboard manipulation, depend on the victim's terminal emulator and its configuration. The 20-character truncation applied to one terminal output path does not provide effective protection because short escape sequences can still fit within that limit. O ...[truncated 2046 chars]- Remediation
View remediation