T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:15
- Finding
- Shell Command Injection Through Unsanitized Application Search and Launch Parameters<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15-42 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Complete Code Snippet ```bash mdfind "kMDItemKind == 'Application'" -name "<关键词>" ``` ```bash open -a "应用名称" ``` ```bash open "/Applications/XXX.app" ``` The placeholders respectively mean “keyword” and “application name.” ### Technical Analysis The skill instructs the agent to place user-controlled search keywords, application names, or resolved paths directly into shell command templates. Quoting a value with double quotes is insufficient if the command is assembled as a shell string without first escaping the value. An attacker can include a closing quotation mark followed by shell syntax in an application keyword or name. The injected quotation mark terminates the intended argument, after which separators, command substitutions, redirections, or additional commands can be interpreted by the shell. For example, if a malicious search value such as the following is inserted verbatim: ```text "; touch /tmp/skill-injection-proof; # ``` the resulting command can be interpreted as: ```bash mdfind "kMDItemKind == 'Application'" -name ""; touch /tmp/skill-injection-proof; #" ``` This issue applies when the agent or its Shell tool constructs and evaluates a command string. It would not be exploitable if the process were launched directly with a safely separated argument array and no intervening shell. ### Attack Path 1. An attacker asks the agent to search for or open an application whose supplied name contains a closing quotation mark and shell metacharacters. 2. The agent follows the documented workflow and inserts that value into the `mdfind` or `open` command template. 3. The Shell tool evaluates the assembled command through a command interpreter. 4. The malicious quotation mark terminates the intended argument. 5. The shell interprets the remaining attacker-controlled text as an additional command ...[truncated 743 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not construct commands by concatenating user-controlled values into shell strings. 2. Invoke `mdfind` and `open` through a process-execution API that accepts an argument array and does not invoke a shell. Keep the executable and every argument in separate fields. 3. Treat both user-supplied names and search-derived paths as untrusted input. 4. Validate application paths after canonicalization. Require a `.app` bundle located beneath an approved directory such as `/Applications`, `/Applications/Utilities`, the current user's `Applications` directory, or `/System/Applications`. 5. Reject values containing null bytes or control characters. If a shell is unavoidable, use a platform-appropriate escaping function rather than manually adding quotation marks. 6. Present resolved matches to the user and require confirmation before launching an application when the match is ambiguous or the path is outside the expected directories. 7. Add tests using quotation marks, command substitutions, separators, newlines, and redirection operators to verify that malicious values remain single literal arguments and cannot create additional commands. ]]>