T09 · Insecure Skill Coding Practices
- Location
SKILL.md:80- Finding
Shell Command Injection and Unsafe Temporary-File Handling in DOCX Export
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 80–81
Vulnerability Type: Shell command injection and insecure predictable temporary file
Risk Level: HighVulnerable Code
bash echo "{{output}}" > /tmp/film-output.md pandoc /tmp/film-output.md -o "{{user-specified-path}}/{{ProjectTitle}}-{{DocumentType}}.docx"Technical Analysis
The documented export workflow interpolates generated or user-controlled values directly into shell commands. The
output,user-specified-path,ProjectTitle, andDocumentTypeplaceholders may contain quotes, command substitutions, shell metacharacters, or control operators. If the agent constructs and executes this command through a shell without strict escaping, crafted input can terminate the quoted value and introduce arbitrary commands.The workflow also uses the fixed, globally predictable path
/tmp/film-output.md. An attacker with local access may create a symbolic link at that location before export. The shell redirection could then overwrite another file writable by the agent. Concurrent exports can also collide, overwrite one another, or expose residual production data to other local users.Attack Path
- An attacker supplies crafted scene content, project metadata, document type, or an export destination containing shell syntax.
- The attacker asks the agent to export the generated document to DOCX.
- The untrusted value is substituted into the documented shell command.
- When the command is evaluated by a shell, the crafted syntax escapes the intended argument and executes an attacker-selected local command.
- The injected command runs with the operating-system privileges of the agent process.
A local symlink attack is also possible:
- A local attacker predicts the fixed path
/tmp/film-output.md. - The attacker creates that path as a symbolic link to another file writable by the agent.
- The export operation executes th ...[truncated 736 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not build export commands by interpolating values into shell command strings.
- Write generated Markdown through a filesystem API rather than
echo. - Create a unique temporary file using a secure facility such as
mktempor the host language's temporary-file API. - Set restrictive permissions on the temporary file and directory, such as owner-only access.
- Invoke
pandocthrough a process API with an argument array and shell evaluation disabled. - Validate
ProjectTitleandDocumentTypeagainst a conservative filename allowlist, rejecting path separators, control characters, shell metacharacters, and traversal sequences. - Canonicalize the requested destination and verify that it remains inside the exact directory approved by the user.
- Avoid overwriting existing output files unless the user explicitly confirms it.
- Remove temporary files in guaranteed cleanup logic, including failure and cancellation paths.
- If a shell is unavoidable, pass data through positional parameters and apply robust platform-specific escaping; however, direct process and filesystem APIs remain the preferred solution.