T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:104- Finding
Shell Command Injection Through Interpolated Skill Arguments
- Content
View full analysis
\ --agent-name "" \ --purpose "" \ --app-id \ --app-secret \ --json-output \ --yes ``` The same unsafe command-generation pattern is repeated in `SKILL.md`, lines 132-140: ```bash python3 scripts/add_feishu_agent.py \ --agent-id trader \ --agent-name "交易小助手" \ --purpose "股票和 ETF 分析" \ --app-id cli_xxx \ --app-secret secret_xxx \ --yes ``` ### Technical Analysis The skill instructs the agent to interpolate conversationally supplied values into a shell command. Double quotes around `agent_name` and `purpose` do not make this safe: an input containing a double quote can terminate the quoted argument and introduce shell syntax. The `agent_id`, `app_id`, and `app_secret` placeholders are not quoted at all. Although `add_feishu_agent.py` uses an argument parser and safely constructs its own subsequent `subprocess.run()` argument list, that protection applies only after the shell has parsed the command. If the agent executes the documented command through a shell tool, command substitution, redirection, separators, or quote termination can execute before Python starts. The Python validation of `agent_id` also occurs too late to prevent shell injection because shell interpretation precedes `validate_request()`. ### Attack Path 1. An attacker asks the agent to create a Feishu agent. 2. The attacker supplies a crafted field, such as an agent name resembling: ```text example"; touch /tmp/skill-command-injection; # ``` 3. The skill follows its documented execution pattern and constructs: ```bash python3 scripts/add_feishu_agent.py \ --agent-name "example"; touch /tmp/skill-command-injection; #" \ ... ``` 4. The shell terminates the ...[truncated 797 chars]- Remediation
View remediation