T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:89- Finding
Command Injection Through Unsafe Heredoc Query Substitution
- Content
View full analysis
/tmp/felo_query.json << 'EOF' {"query": "USER_QUERY_HERE"} EOF # Call Felo API curl -s -X POST https://openapi.felo.ai/v2/chat \ -H "Authorization: Bearer $FELO_API_KEY" \ -H "Content-Type: application/json" \ -d @/tmp/felo_query.json # Clean up rm -f /tmp/felo_query.json ``` The accompanying instruction states: ```text Replace `USER_QUERY_HERE` with the actual user query ``` ### Technical Analysis The skill directs the agent to place an untrusted user query directly into an executable Bash heredoc. Quoting the delimiter as `'EOF'` disables shell expansion within the heredoc body, but it does not prevent delimiter injection. If the query contains a newline followed by `EOF` at the beginning of a line, that line prematurely terminates the heredoc. Any subsequent query content is then interpreted by Bash as shell commands. This converts an ordinary search query into executable shell syntax. Direct substitution also fails to serialize quotation marks, backslashes, control characters, and newlines as JSON. Even when command injection is not attempted, these characters can produce malformed request bodies. ### Attack Path 1. An attacker supplies a search query containing an embedded heredoc terminator and shell commands, conceptually: ```text harmless query EOF attacker_command # ``` 2. The agent follows the skill instruction and replaces `USER_QUERY_HERE` with the query verbatim. 3. Bash encounters the injected standalone `EOF` line and terminates the heredoc early. 4. The subsequent attacker-controlled text is parsed as shell commands. 5. Those commands execute under the operating-system identity and permissions of the agent process. ### Impact Assessment ...[truncated 653 chars]- Remediation
View remediation
"$tmpfile" curl --fail-with-body --silent --show-error \ -X POST 'https://openapi.felo.ai/v2/chat' \ -H "Authorization: Bearer $FELO_API_KEY" \ -H 'Content-Type: application/json' \ --data-binary "@$tmpfile" ``` Additional hardening measures: 1. Preserve the query as data rather than generating a Bash script from it. 2. Use a JSON-aware serializer such as `jq`, Python's `json` module, or an equivalent library. 3. Never instruct the agent to perform literal placeholder replacement inside executable shell syntax. 4. Validate API responses before displaying fields. 5. Add `--fail-with-body`, `--show-error`, and a reasonable timeout to ensure HTTP failures are detected safely. 6. Avoid logging command lines or request headers that could expose the bearer token. ]]>