T09 · Insecure Skill Coding Practices
- Location
issue-templates.md:96- Finding
Repository-Controlled Configuration Allows Arbitrary Command Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:96-98andissue-templates.md:96-98
Vulnerability Type: Command injection through unvalidated project configuration
Risk Level: HighVulnerable Code
Configuration values are extracted directly from the repository-controlled
.multica/squad.mdfile:bash WORK_DIR=$(grep '| work-dir' .multica/squad.md | cut -d'`' -f2) TEST_CMD=$(grep '| test-cmd' .multica/squad.md | cut -d'`' -f2) TYPECHECK_CMD=$(grep '| typecheck-cmd' .multica/squad.md | cut -d'`' -f2)The generated Leader Kickoff instructions subsequently direct an agent to execute those values:
bash # 1. Verify code cd ${WORK_DIR} ${TEST_CMD} # All tests pass ${TYPECHECK_CMD} # TypeScript strict has no errorsTechnical Analysis
The Skill treats values read from
.multica/squad.mdas trusted shell commands without validating them against an allowlist or requiring approval before execution. Because this configuration is part of the target repository, anyone able to prepare or modify that repository can controlTEST_CMD,TYPECHECK_CMD, andWORK_DIR.A command variable expanded as
${TEST_CMD}or${TYPECHECK_CMD}can select an arbitrary executable and provide arguments. For example, an attacker can add a malicious executable or script to the repository and configure the test command to invoke it. The issue template then instructs the Leader agent to execute that command during its normal review loop.WORK_DIRis also interpolated intocdwithout quoting or validation. Although this does not by itself cause shell control operators introduced through variable expansion to be reparsed, it permits unintended argument splitting and directory-selection behavior. It should therefore be considered part of the same unsafe configuration boundary.Attack Path
- An attacker creates or modifies a project containing `.multica/squad.md ...[truncated 1422 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat every value read from
.multica/squad.mdas untrusted input. - Replace free-form
test-cmdandtypecheck-cmdstrings with predefined command identifiers mapped to trusted commands by the Skill or execution environment. - If configurable commands are required, represent the executable and each argument as separate structured fields and reject shell interpreters, unexpected executables, redirection syntax, and control characters.
- Resolve the executable to a canonical path and enforce an explicit allowlist, such as approved package-manager binaries and known project scripts.
- Require explicit user confirmation showing the exact executable and arguments before running any repository-supplied command.
- Validate
WORK_DIRusing canonical path resolution, ensure it is within an approved workspace root, and reject nonexistent paths or paths that escape through symbolic links. - Quote directory variables safely:
bash cd -- "$WORK_DIR"- Execute validation commands in a sandbox with minimal filesystem access, no unnecessary credentials, restricted environment variables, and disabled network access where possible.
- Document
.multica/squad.mdas a security-sensitive configuration file and require review of changes to its command fields.
- Treat every value read from