T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:14- Finding
Shell Command Injection Through Untrusted Request Interpolation
- Content
View full analysis
" --preview ``` ### Technical Analysis The Skill instructs the agent to interpolate the user's complete request into a shell command enclosed in double quotes. Shell double quotes do not neutralize command substitution using `$(...)` or backticks. An attacker can therefore include shell metacharacters in a search request, causing the shell to execute a local command before the Python interpreter receives the argument. The Python script uses `argparse`, which would safely accept the request if it were launched through an argument-array API. The vulnerability is introduced by the documented shell invocation rather than by the argument parser. ### Attack Path 1. An attacker submits a search request containing shell command substitution, such as a request whose query includes `$(attacker_command)`. 2. The agent follows the Skill instructions and inserts the complete request into the documented command. 3. The command is evaluated by a shell. 4. The shell evaluates the command substitution before starting Python. 5. The injected command executes with the same operating-system privileges as the agent process. 6. Python subsequently receives the command output as part of the request argument, potentially concealing the local execution within an otherwise normal search operation. ### Impact Assessment Successful exploitation permits arbitrary local command execution under the agent's account. The attacker could read files accessible to that account, modify the project workspace, access environment variables and credentials, invoke network utilities, or execute additional programs. The vulnerability does not independently grant elevated operating-system privileges, but it exposes all privileges already held by the ...[truncated 132 chars]- Remediation
View remediation