T09 · Insecure Skill Coding Practices
Error
- Location
- references/boundaries.md:168
- Finding
- Arbitrary Command Execution Through Unsafe Path Expansion<![CDATA[ ## Vulnerability Details **File Location**: `references/boundaries.md`, lines 168-170 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash # Expand $VAR in paths eval "echo \"$path\"" | realpath ``` ### Technical Analysis The documented path-resolution pattern passes the value of `path` to `eval`. Unlike ordinary variable expansion, `eval` interprets the resulting value as shell source code. If an untrusted path contains command substitution, shell metacharacters, or crafted quotation characters, the shell can execute those elements before `realpath` performs validation. Path validation must treat input as data. It must not evaluate path strings as shell expressions merely to expand environment variables. ### Attack Path 1. An attacker supplies a path containing shell syntax, such as a command substitution. 2. The Agent follows the documented environment-variable expansion pattern. 3. The path is interpolated into the argument passed to `eval`. 4. `eval` parses the interpolated text as a new shell command. 5. The injected command executes before its output is passed to `realpath`. 6. The attacker-controlled command runs with the privileges and filesystem access of the Agent process. ### Impact Assessment Successful exploitation permits arbitrary command execution under the Agent's operating-system identity. Depending on that identity's permissions, an attacker could read or alter accessible files, expose credentials, execute additional local programs, or compromise workspace integrity. The effect is not limited to path resolution because injected shell commands can perform unrelated operations. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions Remove `eval` entirely and treat all supplied path values as literal data. - Resolve literal paths with a safely quoted command such as `realpath -- "$path"`. - If leading-tilde expansion is required, implement only that specific transformation without invoking a shell evaluator. - Do not support arbitrary shell expressions or command substitutions in paths. - If environment-variable expansion is required, use a strict allowlist of recognized variables and replace them through non-evaluating string operations. - Reject control characters, command-substitution syntax, and unexpected shell metacharacters where appropriate. - Fail closed if canonical path resolution cannot be completed. Example safer handling: ```bash case "$path" in "~") path="$HOME" ;; "~/"*) path="$HOME/${path#\~/}" ;; esac abs_path=$(realpath -- "$path") || { echo "Unable to resolve path" >&2 return 1 } ``` ]]>