T09 · Insecure Skill Coding Practices
Error
- Location
scripts/status.sh:55- Finding
Arbitrary Shell Command Execution Through Unsafe eval of Configuration Values
- Content
View full analysis
/dev/null)" ``` Related unsafe interpolation also occurs in `scripts/status.sh`, lines 81–97 and 105–113: ```bash "$PYTHON" -c " import json, sys try: data = json.load(open('$file', encoding='utf-8')) if isinstance(data, dict): # For catalogs keyed by path or hash if 'files' in data: print(len(data['files'])) else: print(len(data)) elif isinstance(data, list): print(len(data)) else: print('?') except Exception: print('ERR') " 2>/dev/null ``` ```bash "$PYTHON" -c " from pathlib import Path size = Path('$file').stat().st_size for unit in ('B','KB','MB','GB'): if size < 1024 or unit == 'GB': print(f'{size:.1f} {unit}') break size /= 1024 " 2>/dev/null ``` ### Technical Analysis The script imports path values from `config.py`, converts them into shell assignment statements, and sends the generated text to Bash `eval`. `eval` treats its input as executable shell syntax rather than plain data. The generated assignments use double quotes but do not shell-escape the configuration values. If a value contains a double quote, command substitution, shell separator, newline, or similar metacharacter, it can terminate the intended assignment and introduce a new command. These values may ultimately be influenced by `.env` or other configura ...[truncated 1764 chars]- Remediation
View remediation