T09 · Insecure Skill Coding Practices
- Location
SKILL.md:116- Finding
Shell Command Injection Through AI-Generated Reply Content
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 116-117
Vulnerability Type: Shell command injection
Risk Level: Highbash echo "AI-generated reply" | python scripts/reply_wechat.py KittyTechnical Analysis
The documented workflow directs the Agent to place an AI-generated reply inside a double-quoted
echocommand executed by a shell. Double quotes do not prevent shell command substitution. Constructs such as$(command)and backticks are evaluated by the shell before the resulting text is passed toecho.Because the reply is generated from untrusted chat content, a remote participant could attempt to make the generated reply contain shell metacharacters or command-substitution expressions. If the Agent constructs and executes the documented command by textual interpolation, those expressions can execute locally.
Using stdin avoids Python argument-parsing problems, but it does not make shell interpolation safe.
Attack Path
- An attacker sends a WeChat message containing adversarial instructions designed to make the AI reproduce a shell expression, such as a command inside
$(). - The workflow reads the attacker's message through OCR and uses it as generation context.
- The AI generates a reply containing the attacker-selected shell expression.
- The Agent substitutes that reply into the documented
echo "..."command. - The shell evaluates command substitution before piping the reply to
reply_wechat.py. - The injected command executes with the same operating-system privileges as the Agent process.
Impact Assessment
Successful exploitation could permit arbitrary command execution under the Agent's local user account. Depending on that account's permissions, an attacker could read or modify accessible files, obtain local application data, invoke network utilities, tamper with the user's session, or execute additional programs. No privilege escalation beyond the Ag ...[truncated 39 chars]
- An attacker sends a WeChat message containing adversarial instructions designed to make the AI reproduce a shell expression, such as a command inside
- Remediation
View remediation
Remediation Suggestions
- Do not construct a shell command by interpolating AI-generated or user-controlled text.
- Launch Python with a subprocess API that uses an argument array and disables shell processing.
- Pass the reply through the subprocess stdin stream directly.
- For example, use the equivalent of
subprocess.run(["python", "scripts/reply_wechat.py", contact], input=reply, text=True, shell=False). - Treat both the contact and message as untrusted input and validate the contact against an expected recipient list.
- Require user confirmation before sending replies derived from suspicious or operationally sensitive messages.
- Add regression tests containing
$(), backticks, quotes, newlines, redirection operators, and pipe characters.