T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:183
- Finding
- Shell Command Injection Through Untrusted Issue Fields<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 183–188 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash gh issue create \ --repo owner/repo \ --title "<title>" \ --body "<body>" \ --label "bug,priority:high" \ --assignee "@me" ``` ### Technical Analysis The skill directs the agent to place generated issue titles and bodies directly into a shell command. These values originate from user-provided descriptions and therefore must be treated as untrusted. Double quotes do not prevent all shell evaluation. Command substitutions such as `$(command)` and backtick expressions remain active inside double-quoted shell arguments. Embedded quotation marks can also terminate an argument if the agent generates the final command as shell text. Consequently, an attacker can construct issue content that changes the command's interpretation or executes additional local commands. The risk arises before `gh` processes the arguments: the local shell interprets the generated command and evaluates malicious syntax. ### Attack Path 1. An attacker asks the skill to create an issue containing a malicious title or body, such as content with command substitution or shell metacharacters. 2. The skill preserves the attacker-controlled content while drafting the issue. 3. The user authorizes submission. 4. The agent substitutes the generated title or body into the documented `gh issue create` shell command. 5. The local shell evaluates the injected syntax before launching `gh`. 6. The injected command executes with the operating-system privileges and environment of the agent process. ### Impact Assessment Successful exploitation permits arbitrary local command execution with the privileges of the account running the agent. Depending on that account's access, an attacker could: - Read or modify files accessible to the agent. - Access source repositories and local Git configuration. - Obtain environmen ...[truncated 341 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not construct submission commands by concatenating or interpolating issue content into shell source code. - Invoke `gh` through a process-execution API that accepts an argument array and does not invoke a shell. - Store the issue body in a securely created temporary file and use `gh issue create --body-file <file>`. Create the file with restrictive permissions and delete it after submission. - Pass the title as a discrete process argument rather than embedding it in a shell command string. - Apply strict validation to repository identifiers, labels, assignees, and milestones. For example, repository identifiers should match an allowlisted `owner/repository` format. - Display the final destination repository and metadata to the user before performing the authenticated operation. - Add tests using titles and bodies containing quotes, backticks, `$()`, semicolons, newlines, and other shell metacharacters to verify that they remain literal data. ]]>