T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:14- Finding
Unescaped User Input in Executable AppleScript Template
- Content
View full analysis
+18888888888) 3. Use AppleScript to send the message ## AppleScript Command ```bash osascript << 'EOF' tell application "Messages" activate send "MESSAGE_TEXT" to buddy "+1PHONE_NUMBER" end tell EOF ``` ``` ### Technical Analysis Both `MESSAGE_TEXT` and `PHONE_NUMBER` represent values derived from the user's request. The template places them directly inside quoted AppleScript string literals. It does not require escaping quotation marks, backslashes, line breaks, or AppleScript control characters. If an implementation replaces the placeholders directly, crafted input can terminate the intended string and append additional AppleScript statements. Because `osascript` executes the generated text as code, injected statements would run with the privileges and macOS permissions of the invoking process. There is also a potential shell-injection path if multiline user input is placed into the heredoc before shell execution. An input containing a line that exactly matches `EOF` could prematurely terminate the heredoc and cause subsequent input to be interpreted by the shell. The quoted heredoc delimiter prevents ordinary shell expansion inside the body, but it does not make dynamically generated heredoc content safe or prevent premature delimiter termination. ### Attack Path 1. An attacker supplies a crafted message or phone-number value containing a closing quote, newline, and additional AppleScript syntax. 2. The agent ...[truncated 1374 chars]- Remediation
View remediation