T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:80
- Finding
- Shell Command Injection and Unsafe Temporary-File Handling in DOCX Export## Vulnerability Details **File Location**: `SKILL.md`, lines 80–81 **Vulnerability Type**: Shell command injection and insecure predictable temporary file **Risk Level**: High ### Vulnerable Code ```bash echo "{{output}}" > /tmp/film-output.md pandoc /tmp/film-output.md -o "{{user-specified-path}}/{{ProjectTitle}}-{{DocumentType}}.docx" ``` ### Technical Analysis The documented export workflow interpolates generated or user-controlled values directly into shell commands. The `output`, `user-specified-path`, `ProjectTitle`, and `DocumentType` placeholders may contain quotes, command substitutions, shell metacharacters, or control operators. If the agent constructs and executes this command through a shell without strict escaping, crafted input can terminate the quoted value and introduce arbitrary commands. The workflow also uses the fixed, globally predictable path `/tmp/film-output.md`. An attacker with local access may create a symbolic link at that location before export. The shell redirection could then overwrite another file writable by the agent. Concurrent exports can also collide, overwrite one another, or expose residual production data to other local users. ### Attack Path 1. An attacker supplies crafted scene content, project metadata, document type, or an export destination containing shell syntax. 2. The attacker asks the agent to export the generated document to DOCX. 3. The untrusted value is substituted into the documented shell command. 4. When the command is evaluated by a shell, the crafted syntax escapes the intended argument and executes an attacker-selected local command. 5. The injected command runs with the operating-system privileges of the agent process. A local symlink attack is also possible: 1. A local attacker predicts the fixed path `/tmp/film-output.md`. 2. The attacker creates that path as a symbolic link to another file writable by the agent. 3. The export operation executes th ...[truncated 736 chars]
- Remediation
- ## Remediation Suggestions 1. Do not build export commands by interpolating values into shell command strings. 2. Write generated Markdown through a filesystem API rather than `echo`. 3. Create a unique temporary file using a secure facility such as `mktemp` or the host language's temporary-file API. 4. Set restrictive permissions on the temporary file and directory, such as owner-only access. 5. Invoke `pandoc` through a process API with an argument array and shell evaluation disabled. 6. Validate `ProjectTitle` and `DocumentType` against a conservative filename allowlist, rejecting path separators, control characters, shell metacharacters, and traversal sequences. 7. Canonicalize the requested destination and verify that it remains inside the exact directory approved by the user. 8. Avoid overwriting existing output files unless the user explicitly confirms it. 9. Remove temporary files in guaranteed cleanup logic, including failure and cancellation paths. 10. If a shell is unavoidable, pass data through positional parameters and apply robust platform-specific escaping; however, direct process and filesystem APIs remain the preferred solution.