T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:68- Finding
Unvalidated Metadata and User Input Interpolated into Shell Commands
- Content
View full analysis
git init git add -A git commit -m "Release: v" gh repo create / --public --description "" --source . --push ``` ```bash clawhub publish \ --slug \ --name "" \ --version \ --tags "" \ --changelog "" ``` Additional unquoted substitutions occur in community publishing commands: ```bash git checkout -b add- mkdir cp /SKILL.md /SKILL.md ``` ### Technical Analysis The skill instructs an agent to substitute values such as the skill directory, skill name, version, description, tags, changelog, and GitHub username directly into shell command templates. Several substitutions are unquoted, while quoted substitutions are still unsafe if the generated value is not escaped before inclusion in a shell command. The validation procedure only displays the first ten lines of `SKILL.md`: ```bash head -10 SKILL.md ``` It does not enforce a character allowlist, validate YAML field types, canonicalize paths, or reject shell metacharacters. If an agent follows these instructions by constructing a command string and invoking it through a shell, attacker-controlled metadata can alter the command's syntax. Potentially dangerous characters include command separators, command substitutions, redirection operators, quotes, and newline characters. Quoting alone is insufficient when a value can contain a quote that terminates the intended quoted argument. ### Attack Path 1. An attacker supplies a skill directory containing crafted YAML metadata, or asks the publishing agent t ...[truncated 1382 chars]- Remediation
View remediation
` and verify that it is an expected directory before use. 4. Execute commands through an argument-array API without a shell. For example, pass `["clawhub", "publish", skillDir, "--slug", slug]` directly to the process launcher. 5. Do not form executable shell commands by concatenating metadata or user input. 6. If shell execution is unavoidable, use a proven shell-escaping implementation for every dynamic argument and reject newline characters. 7. Display the exact validated arguments and destination repositories to the user before execution. 8. Require explicit confirmation before repository creation, public upload, or marketplace publication. ]]>