T09 · Insecure Skill Coding Practices
Warning
- Location
install.sh:101- Finding
Unescaped MCP URL Allows TOML Configuration Injection
- Content
View full analysis
&2; exit 2 ;; esac done ``` ```bash merge_codex(){ local file="$HOME/.codex/config.toml" [ -d "$HOME/.codex" ] || return 1 if [ -f "$file" ] && grep -q "^\[mcp_servers\.${MCP_NAME}\]" "$file"; then say "OK $file (already registered)" return 0 fi if [ "$DRY_RUN" = "1" ]; then say "WOULD append [mcp_servers.$MCP_NAME] to $file" return 0 fi [ -f "$file" ] && [ ! -f "$file.bak" ] && cp "$file" "$file.bak" mkdir -p "$HOME/.codex" { echo echo "[mcp_servers.${MCP_NAME}]" echo "url = \"${MCP_URL}\"" } >> "$file" say "ADDED $MCP_NAME in $file" } ``` ### Technical Analysis The MCP URL can be supplied through either the `PRICEWIN_MCP_URL` environment variable or the `--url` command-line argument. The value is interpolated directly into a quoted TOML string without validation or TOML escaping. A value containing quotation marks and newline characters can terminate the intended `url` value and insert additional TOML sections or properties into `~/.codex/config.toml`. Shell quoting prevents immediate shell-command substitution while the installer runs, but it does not prevent configuration injection into the generated TOML. The JSON configuration path does not have this specific issue because Node's `JSON.stringify` escapes values during serialization. The vulnerable path is the manually generated Codex TOML block. ### Attack Path 1. An attacker persuades the user to execute the installer with a craft ...[truncated 1832 chars]- Remediation
View remediation