T09 · Insecure Skill Coding Practices
Error
- Location
scripts/stt.sh:103- Finding
Arbitrary Python Code Execution Through Shell Variable Interpolation
- Content
View full analysis
') f.write(f'{int(end//3600):02d}:{int((end%3600)//60):02d},{int((end%1)*1000):03d}\\n') f.write(f'{content}\\n\\n') else: with open('$OUTPUT_FILE', 'w') as f: f.write(text) print(f'Transcription saved to: $OUTPUT_FILE') print(f'Text: {text[:200]}...') " ``` ### Technical Analysis The script constructs an entire Python program inside a double-quoted shell string and directly interpolates `MODEL`, `FORMAT`, `OUTPUT_FILE`, and `AUDIO_PATH` into single-quoted Python string literals. The shell parser does not validate the option values against the documented model and format choices. Consequently, an input containing a single quot ...[truncated 2515 chars]- Remediation
View remediation
&2; exit 2 ;; esac case "$FORMAT" in txt|srt|vtt|json) ;; *) echo "Invalid format" >&2; exit 2 ;; esac ``` 4. Validate that options requiring a value actually have a following argument before reading `$2`. 5. Obtain the downloaded filename deterministically from `yt-dlp`, such as by using its printed post-processing path, instead of selecting the newest arbitrary entry with `ls`. 6. Keep generated audio in a per-run directory created with `mktemp -d`, apply restrictive permissions, and remove it after transcription. 7. If arbitrary output paths are unnecessary, constrain output to the designated output directory and reject paths that resolve outside it. ]]>