T09 · Insecure Skill Coding Practices
Error
- Location
scripts/github-clone.sh:232- Finding
Arbitrary Command Execution Through Unsafe Shell Command Construction
- Content
View full analysis
&1; then ``` ```bash clone_cmd="git clone $DEPTH" if [ -n "$BRANCH" ]; then clone_cmd="$clone_cmd --branch $BRANCH" fi clone_cmd="$clone_cmd $PROXY_URL $TARGET" if timeout $CLONE_TIMEOUT bash -c "$clone_cmd" 2>&1; then ``` ```bash clone_cmd="git clone $DEPTH" if [ -n "$BRANCH" ]; then clone_cmd="$clone_cmd --branch $BRANCH" fi clone_cmd="$clone_cmd $HTTPS_URL $TARGET" if timeout $CLONE_TIMEOUT bash -c "$clone_cmd" 2>&1; then ``` ### Technical Analysis The script constructs shell commands by concatenating caller-controlled values and then evaluates the resulting strings using `bash -c`. Values such as `TARGET`, `BRANCH`, and `OREF` are not quoted or constrained before being inserted into these command strings. Shell metacharacters in these values are consequently interpreted as syntax by the new Bash process rather than being passed to Git as literal arguments. A malicious value can introduce command separators, redirections, pipelines, command substitutions, or comments. The repository URL parser also accepts any non-slash characters for repository owner and repository name fields: ```bash if [[ "$url" =~ ^https://github\.com/([^/]+)/([^/]+)(\.git)?$ ]]; then ``` This allows shell metacharacters to enter generated clone URLs and reach the same `bash -c` execution paths. Although `CLONE_TIMEOUT` is not embedded inside the `bash -c` string, it is also not validated as a positive integer. It can therefore manipulate `timeout` arguments or cause unexpected execution failures. ### Attack Path 1. An attacker causes the Skill to invoke the script with a ...[truncated 1239 chars]- Remediation
View remediation