T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:73- Finding
Shell Command Injection Through Verbatim User Query Interpolation
- Content
View full analysis
` is **always the user's original message, copied word-for-word**. Do NOT translate, rephrase, expand, polish, or "improve" it in any way. Show this exact text in the confirmation. If user confirms → submit this exact text. If user edits → the edited text becomes the new verbatim query. ``` ```markdown **Then call the tool:** ``` node tools/chartgen_api.js submit "" [files...] ``` ``: **Copy-paste the confirmed text from STEP 1** — the user's original words or, for file uploads, the chosen option text. Never rewrite. ``: current channel name, e.g. `Signal`, `WhatsApp`, `Web`. `[files...]`: optional, space-separated absolute paths to data files. ``` ### Technical Analysis The skill requires the agent to copy attacker-controlled user input verbatim into a shell command enclosed only by double quotes. Double quotes do not neutralize shell command substitutions such as `$(...)` or backticks. Embedded quotation marks can also terminate the intended argument and introduce shell operators. If the agent follows the documented workflow through a shell-backed execution tool, the shell interprets metacharacters before Node.js receives `process.argv`. The JavaScript tool cannot protect against this issue because exploitation occurs before `chartgen_api.js` starts. Confirmation is not a security boundary. A user can deliberately confirm a malicious query, while another user might confirm text whose shell significance is not apparent. ### Attack Path 1. An attacker submits a visualization request containing shell syntax, such as: ```text Create a chart named "$(id > /tmp/chartgen-command-executed)" ``` 2. The skill requires the request to be preserved word-for-word and shown for con ...[truncated 1258 chars]- Remediation
View remediation