T09 · Insecure Skill Coding Practices
Error
- Location
examples/gateway-integration-v2.ts:46- Finding
Shell Command Injection in Gateway Voice Processing Examples
- Content
View full analysis
/dev/null` ); // 4. Whisper 识别 (medium 模型) log?.info(`🤖 正在识别语音...`); await execPromise( `whisper --model medium --language zh ${wavPath} --output_dir ${downloadDir} --verbose False` ); ``` From `examples/gateway-integration.ts:30-54`: ```typescript await new Promise((resolve, reject) => { exec(`bash ${decoderPath}/converter.sh ${fixedPath} mp3`, (err, stdout, stderr) => { if (err) { log.error(`❌ 解码失败：${stderr}`); reject(err); } else { log.info(`✅ 解码完成`); resolve(); } }); }); // 3. Whisper 识别文字 const model = process.env.WHISPER_MODEL || 'base'; const language = process.env.WHISPER_LANGUAGE || 'zh'; const transcript = await new Promise((resolve, reject) => { exec( `whisper --model ${model} --language ${language} ${outputMp3} --output_dir ${os.tmpdir()} --verbose False`, (err, stdout, stderr) => { if (err) { log.error(`❌ 识别失败：${stderr}`); reject(err); } else { const txtPath = outputMp3 + '.txt'; ``` The same unsafe command-construction pattern is presented as recommended integration code in `README.md:98-109` and `SKILL.md:72-80`. ### Technical Analysis Node.js `exec` executes the supplied string through a system shell. The code directly interpolates the following values into shell command strings: - `localPath` and derivative paths such as `fixedPath`, `pcmPath`, ` ...[truncated 2660 chars]- Remediation
View remediation