T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:115- Finding
Shell Command Injection Through Unquoted SQLite Database Path
- Content
View full analysis
Tracker Backend > SQLite DB path` - Default: `~/.offerplus/applications.db` - On first use, initialize the DB: `swelist tracker init --db ` Or directly: `sqlite3 "CREATE TABLE IF NOT EXISTS applications (name TEXT PRIMARY KEY, status TEXT NOT NULL, job_id TEXT, applied_on TEXT, notes TEXT, updated_at TEXT DEFAULT (datetime('now')));"` ``` The unsafe pattern is repeated throughout the workflow: ```text existing_rows = sqlite3 DB_PATH "SELECT name, company, status FROM applications" ``` ```text sqlite3 DB_PATH "INSERT OR IGNORE INTO applications (name,status,company,job_id,applied_on,last_touch,interview_date,next_action,link,tags) VALUES (?,?,?,?,?,?,?,?,?,?)" ``` ```text sqlite3 DB_PATH "UPDATE applications SET status=?, last_touch=?, next_action=?, interview_date=COALESCE(?,interview_date), link=COALESCE(?,link), tags=COALESCE(?,tags), updated_at=datetime('now') WHERE name=?" ``` ```text stale = sqlite3 DB_PATH "SELECT name, status, last_touch FROM applications WHERE status NOT IN ('Rejected','Withdrawn','Offer') AND (date(COALESCE(last_touch, updated_at)) < date('now','-30 days')) AND COALESCE(next_action,'') != 'Follow up'" FOR each stale row: sqlite3 DB_PATH "UPDATE app ...[truncated 2657 chars]- Remediation
View remediation