T09 · Insecure Skill Coding Practices
- Location
scripts/send-email.sh:8- Finding
Arbitrary Shell Command Execution Through Unsafe .env Loading
- Content
View full analysis
Vulnerability Details
File Location:
scripts/send-email.sh, lines 8–12
Vulnerability Type: Unsafe execution of configuration data
Risk Level: Mediumbash if [ -f "${ROOT_DIR}/.env" ]; then set -a # shellcheck disable=SC1091 . "${ROOT_DIR}/.env" set +a fiTechnical Analysis
The script loads the project-root
.envfile with the shell dot command (.). Dot-sourcing does not treat the file as passive configuration: it parses and executes its contents as shell code in the current process.Consequently, an attacker who can create or modify the skill-root
.envfile can insert command substitutions, shell functions, redirections, or arbitrary commands. These commands execute wheneverscripts/send-email.shis invoked. Execution occurs before the script validates its argument count or checks the required environment variables, so even an otherwise invalid invocation triggers the malicious content.The repository does not contain a malicious
.env, and no evidence of intentional malicious behavior was identified. The vulnerability depends on an attacker or another compromised process gaining write access to that external configuration file.Attack Path
- An attacker gains the ability to create or modify
.envin the project root. - The attacker adds shell code to the file, for example:
bash RESEND_API_KEY=placeholder RESEND_FROM=sender@example.com arbitrary_attacker_command - A user or agent invokes
scripts/send-email.sh. - Lines 8–12 dot-source
.env. - The injected command executes with the same operating-system identity and permissions as the invoking user or agent.
- The injected code can access data available to that process, including exported secrets and readable local files, and can perform any network or filesystem operation permitted to that identity.
Impact Assessment
Successful exploitation provides arbitrary command execution under the privileges of the user or agent r ...[truncated 457 chars]
- An attacker gains the ability to create or modify
- Remediation
View remediation
Remediation Suggestions
- Do not load
.envwithsourceor the dot command. - Replace executable loading with a parser that accepts only an explicit allowlist of keys, such as
RESEND_API_KEYandRESEND_FROM. - Reject malformed lines, unknown keys, command substitutions, shell metacharacters, and unsupported quoting rather than evaluating them.
- Prefer supplying secrets through a trusted process environment or secret manager instead of a repository-local file.
- Verify that any local configuration file is a regular file, is owned by the expected user, is not a symbolic link, and is not writable by group or other users.
- Apply restrictive permissions such as
0600to files containing credentials. - Keep validation and JSON serialization of email fields, but ensure configuration values are never evaluated as shell syntax.
- Do not load