T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:18- Finding
Shell Command Injection Through User-Controlled Command Arguments
- Content
View full analysis
" --font_name "<字体>" --color "<颜色>" --language "<语言>" --report "" ``` ```text node {{SKILL_PATH}}/scripts/chatppt_creator.js create_from_custom_outline --custom_data '' --font_name "<字体>" --color "<颜色>" --report "" ``` ```text node {{SKILL_PATH}}/scripts/chatppt_creator.js create_from_project_analysis --project_path "<项目绝对路径>" --user_prompt "<汇报重点>" ``` ```text node {{SKILL_PATH}}/scripts/chatppt_creator.js create_banana_ppt --text "<主题>" --style "<风格ID>" --complex "<1/2/3>" ``` ### Technical Analysis The command templates use shell quoting but do not define any escaping or validation procedure for embedded quotation marks, command substitutions, separators, redirections, or other shell metacharacters. Although `scripts/chatppt_creator.js` reads values through `process.argv` and does not itself invoke a shell, the command generated from these templates is processed by the calling shell before Node.js starts. An attacker can terminate the quoted argument and append a new shell command. For example, a malicious topic could conceptually contain: ```text "; attacker-controlled-command; # ``` When inserted into the documented `--text` template, the shell interprets the injected text as a separate command instead of presentation content. Single-quoted JSON arguments are similarly vulnerable when attacker-controlled data contains a single quote. ### Attack Path 1. An attacker provides a crafted presentation topic, user prompt, local path, outline value, or reference URL containing shell metacharacters ...[truncated 1184 chars]- Remediation
View remediation