T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/send_file.py:80- Finding
Control-Field Injection Through Unencoded Line-Oriented Output
- Content
View full analysis
3 else "" account_id = sys.argv[4] if len(sys.argv) > 4 else "CyreneAssistant_bot" ``` ```python filename = os.path.basename(src_path) ``` ```python print(f"SEND_PATH={send_path}") print(f"SEND_FILENAME={send_filename}") print(f"TARGET={target}") print(f"CAPTION={caption}") print(f"ACCOUNT_ID={account_id}") print("READY") ``` The corresponding parsing instruction is: ```markdown Extract `SEND_PATH`, `TARGET`, `ACCOUNT_ID` from the output. ``` ### Technical Analysis The script creates a line-oriented control protocol by directly interpolating caller-controlled values into `KEY=VALUE` records. The target, caption, account ID, and source filename are not validated or encoded before being printed. On filesystems and command-line interfaces that permit newline characters in these values, an attacker can inject additional protocol records such as `TARGET=...`, `ACCOUNT_ID=...`, `SEND_PATH=...`, or `READY`. The Skill documentation does not define a strict grammar, reject duplicate keys, or specify whether the first or last occurrence of a key takes precedence. Consequently, exploitation depends on the consuming Agent's parsing behavior, but the protocol itself does not preserve a trustworthy boundary between data and control fields. ### Attack Path 1. An attacker creates or selects a file whose basename contains newline characters followed by forged control records, or supplies newline-bearing target, caption, or account ID arguments. 2. The attacker asks the Agent to send that file through this Skill. 3. The script places the untrusted basename in `SEND_PATH` and `SEND_FILENAME`, or directly emits another untrusted argument. 4. The embedd ...[truncated 938 chars]- Remediation
View remediation