T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:104
- Finding
- Shell Command Injection Through Interpolated Skill Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 104-115 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash python3 scripts/add_feishu_agent.py \ --agent-id <agent-id> \ --agent-name "<agent-name>" \ --purpose "<purpose>" \ --app-id <app-id> \ --app-secret <app-secret> \ --json-output \ --yes ``` The same unsafe command-generation pattern is repeated in `SKILL.md`, lines 132-140: ```bash python3 scripts/add_feishu_agent.py \ --agent-id trader \ --agent-name "交易小助手" \ --purpose "股票和 ETF 分析" \ --app-id cli_xxx \ --app-secret secret_xxx \ --yes ``` ### Technical Analysis The skill instructs the agent to interpolate conversationally supplied values into a shell command. Double quotes around `agent_name` and `purpose` do not make this safe: an input containing a double quote can terminate the quoted argument and introduce shell syntax. The `agent_id`, `app_id`, and `app_secret` placeholders are not quoted at all. Although `add_feishu_agent.py` uses an argument parser and safely constructs its own subsequent `subprocess.run()` argument list, that protection applies only after the shell has parsed the command. If the agent executes the documented command through a shell tool, command substitution, redirection, separators, or quote termination can execute before Python starts. The Python validation of `agent_id` also occurs too late to prevent shell injection because shell interpretation precedes `validate_request()`. ### Attack Path 1. An attacker asks the agent to create a Feishu agent. 2. The attacker supplies a crafted field, such as an agent name resembling: ```text example"; touch /tmp/skill-command-injection; # ``` 3. The skill follows its documented execution pattern and constructs: ```bash python3 scripts/add_feishu_agent.py \ --agent-name "example"; touch /tmp/skill-command-injection; #" \ ... ``` 4. The shell terminates the ...[truncated 797 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not ask the agent to construct a shell command by interpolating user input. - Invoke the script through a structured process API with a discrete argument array and with shell execution disabled. For example: ```python subprocess.run( [ sys.executable, "scripts/add_feishu_agent.py", "--agent-id", agent_id, "--agent-name", agent_name, "--purpose", purpose, "--app-id", app_id, "--app-secret-stdin", "--json-output", "--yes", ], input=app_secret, text=True, check=True, shell=False, ) ``` - If the skill runtime only exposes a shell interface, generate a temporary argument file with restrictive permissions or apply a proven platform-specific shell-escaping function to every argument. Manual quote replacement is not sufficient. - Validate all fields before invoking any shell or process tool. Apply strict formats to IDs and reasonable length and character restrictions to display fields. - Add adversarial tests covering double quotes, single quotes, semicolons, newlines, command substitution, backticks, redirection, and shell metacharacters. ]]>