T09 · Insecure Skill Coding Practices
Error
- Location
- tools/exec.js:5
- Finding
- Unrestricted Shell Command Execution Through Caller-Controlled Input## Vulnerability Details **File Location**: `tools/exec.js`, lines 5-11 **Vulnerability Type**: OS command injection and unrestricted shell execution **Risk Level**: High ### Vulnerable Code ```js module.exports = async (command, options = {}) => { try { const { stdout, stderr } = await execAsync(command, { cwd: options.cwd || process.cwd(), env: { ...process.env, ...options.env }, timeout: options.timeout || 30000 }); ``` ### Technical Analysis The exported tool passes the caller-controlled `command` string directly to Node.js `child_process.exec`. This API executes the supplied string through a system shell, so shell operators and constructs such as command chaining, pipelines, redirects, variable expansion, and command substitution are interpreted. No executable allowlist, argument validation, shell-metacharacter rejection, authorization check, or confirmation mechanism is implemented. The caller may also override the working directory and add or replace environment variables. Although `SKILL.md` states that sensitive operations require confirmation, this requirement is not enforced by the code. ### Attack Path 1. An attacker directly supplies, or causes prompt-injected content to influence, the `command` tool argument. 2. The Agent invokes the exported `exec` tool with the attacker-influenced string. 3. `execAsync` passes that string to a system shell without validation. 4. The shell interprets all included commands, substitutions, redirects, and chained operations. 5. The commands execute with the operating-system privileges of the process hosting the Skill. For example, input presented as a benign diagnostic command could append an additional command through shell chaining. No second authorization boundary prevents execution of the appended operation. ### Impact Assessment Successful exploitation permits arbitrary command execution with the privileges of the host Agent ...[truncated 370 chars]
- Remediation
- ## Remediation Suggestions - Replace `child_process.exec` with `execFile` or `spawn` using a fixed executable and a separately constructed argument array. - Define a narrow allowlist of permitted executables and validate every argument against command-specific rules. - Do not accept arbitrary shell syntax. Reject shell metacharacters, redirects, substitutions, and command separators if shell execution cannot be completely removed. - Require explicit, independently verified user approval before any destructive, sensitive, or state-changing operation. - Restrict `cwd` to approved directories and prevent arbitrary environment-variable overrides. - Run the Skill in a sandboxed, least-privileged account with constrained filesystem and network access. - Add security tests covering command chaining, command substitution, redirects, malicious environment values, and unauthorized working directories.