T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:14
- Finding
- Unescaped User Input in Executable AppleScript Template<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14-24 **Vulnerability Type**: AppleScript and potential shell command injection **Risk Level**: High The skill directs the agent to extract a user-controlled phone number and message and insert them into an executable AppleScript template without defining validation, escaping, or safe argument passing. ### Vulnerable Code ```markdown 1. Extract the phone number and message from user's request 2. Format phone number with +1 prefix for US numbers (e.g., 8888888888 -> +18888888888) 3. Use AppleScript to send the message ## AppleScript Command ```bash osascript << 'EOF' tell application "Messages" activate send "MESSAGE_TEXT" to buddy "+1PHONE_NUMBER" end tell EOF ``` ``` ### Technical Analysis Both `MESSAGE_TEXT` and `PHONE_NUMBER` represent values derived from the user's request. The template places them directly inside quoted AppleScript string literals. It does not require escaping quotation marks, backslashes, line breaks, or AppleScript control characters. If an implementation replaces the placeholders directly, crafted input can terminate the intended string and append additional AppleScript statements. Because `osascript` executes the generated text as code, injected statements would run with the privileges and macOS permissions of the invoking process. There is also a potential shell-injection path if multiline user input is placed into the heredoc before shell execution. An input containing a line that exactly matches `EOF` could prematurely terminate the heredoc and cause subsequent input to be interpreted by the shell. The quoted heredoc delimiter prevents ordinary shell expansion inside the body, but it does not make dynamically generated heredoc content safe or prevent premature delimiter termination. ### Attack Path 1. An attacker supplies a crafted message or phone-number value containing a closing quote, newline, and additional AppleScript syntax. 2. The agent ...[truncated 1374 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Do not interpolate user-controlled values into AppleScript source code or dynamically generated heredoc structure. Pass the phone number and message as positional arguments so they remain data rather than executable syntax: ```bash osascript - "$phone" "$message" <<'APPLESCRIPT' on run argv set phoneNumber to item 1 of argv set messageText to item 2 of argv tell application "Messages" send messageText to buddy phoneNumber end tell end run APPLESCRIPT ``` Apply the following additional controls: 1. Validate recipients against an explicit international telephone-number format, such as `^\+[1-9][0-9]{7,14}$`. 2. Normalize US numbers in application logic before invoking AppleScript rather than by textual source-code replacement. 3. Reject unexpected control characters and line breaks in phone-number fields. 4. Preserve message text as an argument without evaluating or embedding it as source code. 5. Invoke `osascript` through an argument-array API rather than a shell whenever the host environment supports it. 6. Avoid `eval`, dynamically constructed shell commands, and dynamically generated heredoc delimiters or bodies. 7. Ask the user to confirm the normalized recipient and final message before sending. 8. Grant only the minimum macOS Automation permissions required for Messages; do not request Accessibility permission unless a documented feature strictly requires it. 9. Add tests using quotation marks, backslashes, multiline text, `EOF`, and AppleScript-like payloads to verify that all input is treated exclusively as data. ]]>