T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:91- Finding
Shell Command Injection Through User-Controlled OAuth Token Binding
- Content
View full analysis
' ``` The receiving token parser does not constrain the input to a safe token character set: ```python _TOKEN_INLINE_RE = re.compile(r"^X-(.+?)-TANDON-CODE$", re.IGNORECASE) def _extract_token(raw: str) -> str: if not raw: return "" s = raw.strip() m = _TOKEN_INLINE_RE.match(s) if m: return m.group(1).strip() return s ``` ### Technical Analysis The Skill instructs the Agent to place untrusted, user-supplied text directly inside a single-quoted shell command. A single quote in the pasted value can terminate the intended quoted argument. Shell metacharacters that follow can then be interpreted by the shell rather than passed to Python as token data. The Python-side `_extract_token` function does not prevent this upstream vulnerability. It accepts arbitrary nonempty input when the optional wrapper pattern does not match, and the wrapper pattern itself permits essentially arbitrary characters. Validation therefore occurs neither before shell interpolation nor after the value reaches the script. This is an insecure invocation pattern even though `andon_auth.py` does not independently invoke a shell. ### Attack Path 1. An attacker provides a purported OAuth temporary code containing a single quote followed by shell syntax. 2. The Agent follows the documented binding workflow and substitutes the value into: ```bash python3 .../andon_auth.py --save '' ``` 3. The embedded quote closes the original shell argument. 4. Subsequent shell operators cause attacker-selected commands to execute. 5. Those commands run with the same operating-system privileges and filesystem access as the Agent process. For exampl ...[truncated 740 chars]- Remediation
View remediation