T09 · Insecure Skill Coding Practices
- Location
SKILL.md:120- Finding
Shell Command Injection Through Unsafe User-Input Interpolation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 120–132
Vulnerability Type: Shell command injection caused by unsafe interpolation into a double-quoted JSON argument
Risk Level: HighVulnerable Code
bash # Example: Run apex + consult + research on the same query for ENGINE_ID in apex consult research; do curl -s --max-time 120 -X POST https://api.neurodoc.app/aetherlang/execute \ -H "Content-Type: application/json" \ -H "X-Aether-Key: MASTERSWARM_API_KEY" \ -d "{ \"code\": \"flow M {\n using target \\\"neuroaether\\\" version \\\">=0.2\\\";\n input text query;\n node G: guard mode=\\\"STANDARD\\\";\n node E: $ENGINE_ID style=\\\"professional\\\";\n G -> E;\n output text result from E;\n}\", \"query\": \"USER_QUESTION\" }" doneTechnical Analysis
The multi-engine usage example instructs users or agents to replace
USER_QUESTIONwith untrusted question text inside a shell double-quoted argument. Double quotes do not suppress shell command substitution. Consequently, constructs such as$(command)or backtick command substitution embedded in the question can be evaluated by the local shell beforecurlexecutes.User input containing quotation marks, backslashes, or JSON control characters can also terminate or corrupt the intended JSON value. This creates both a shell-injection risk and unreliable JSON serialization. The remote API's guard node cannot prevent this issue because shell expansion occurs locally before the request reaches the API.
Attack Path
- An attacker supplies a document or question containing shell syntax such as
$(attacker_command). - An agent or user follows the documented multi-engine workflow and substitutes the supplied content directly for
USER_QUESTION. - The resulting content remains inside a shell double-quoted
-dargument. - The local shell evaluates the embedded command substitution before in ...[truncated 916 chars]
- An attacker supplies a document or question containing shell syntax such as
- Remediation
View remediation
Remediation Suggestions
Do not construct JSON by substituting untrusted text into a shell-quoted string. Use a JSON serializer so all quotation marks, backslashes, control characters, and shell metacharacters are encoded as data.
A safer pattern is:
bash CODE='flow M { using target "neuroaether" version ">=0.2"; input text query; node G: guard mode="STANDARD"; node E: apex style="professional"; G -> E; output text result from E; }' jq -n \ --arg code "$CODE" \ --arg query "$USER_QUESTION" \ '{code: $code, query: $query}' > request.json curl -s --max-time 120 \ -X POST https://api.neurodoc.app/aetherlang/execute \ -H "Content-Type: application/json" \ -H "X-Aether-Key: $MASTERSWARM_API_KEY" \ --data-binary @request.jsonAdditional hardening measures:
- Prefer an HTTP SDK that accepts structured request objects rather than constructing requests through shell interpolation.
- Pass user input through environment variables, standard input, or files and then serialize it with a trusted JSON library.
- Never use
eval,sh -c, or equivalent dynamic shell evaluation with document contents or user questions. - Execute the connector with least privilege and provide only the credentials and filesystem access required for the request.
- Add tests containing command substitutions, backticks, quotes, backslashes, newlines, and JSON control characters to verify they remain inert data.
- Update both single-engine and multi-engine examples to consistently reference the API key through the environment variable rather than showing literal placeholder substitution.