T09 · Insecure Skill Coding Practices
Error
- Location
safe-shell.js:62- Finding
Shell command validation can be bypassed through unhandled control operators
- Content
View full analysis
trimmed === cmd || trimmed.startsWith(cmd + ' ') || trimmed.startsWith(cmd + '\t') ); if (!isAllowed) { return { safe: false, reason: 'Command is not in the allowlist', blocked: false }; } return { safe: true }; ``` The approved, unchanged command is subsequently displayed for execution by a separate tool: ```javascript console.log(`Approved command: ${command}`); console.log('Actual execution must be performed through the exec tool'); ``` ### Technical Analysis The allowlist only verifies that the supplied string begins with an approved executable name. It does not parse the command into an executable and arguments, nor does it comprehensively reject shell syntax. The blocked-pattern list does not prohibit all of the following constructs: - Semicolon command sequencing - `&&` and `||` conditional execution - Arbitrary pipelines - Command substitution - Relative-path output redirection - Shell-specific expansion and quoting behaviors Consequently, input beginning with an allowed command can contain an additional unapproved operation. The complete string is then presented as approved and intended to be passed to an external execution tool. This also contradicts the documentation in `SKILL.md:185`, which states that command chains such as `;`, `&&`, and `||` are blocked. The JavaScript file does not directly execute the command, so exploitation depends on an agent or downstream component trusting the validator and passing the approved string to a shell. That downstream behavior is explicitly contemplated by the program's execution message. # ...[truncated 1362 chars]- Remediation
View remediation