T09 · Insecure Skill Coding Practices
Error
- Location
- launch.md:53
- Finding
- Shell command injection through unsafe interpolation of user-controlled prompts and names<![CDATA[ ## Vulnerability Details **File Location**: `launch.md:53-56`, `launch.md:84-88`, and `send.md:76-80` **Vulnerability Type**: Shell command injection caused by unsafe command construction **Risk Level**: High ### Vulnerable Code From `launch.md:53-56`: ```bash ## Independent new worktree (default) ```bash ORCA worktree create --repo id:<repoId> --name <task-name> --no-parent --agent <agent> --prompt "<task brief>" --json ``` ``` From `launch.md:84-88`: ```bash ```bash ORCA worktree create --name <task-name> --no-parent --json ORCA terminal create --worktree id:<repoId>::<newWorktreePath> --title <task-name> --command 'codex --model gpt-5.5 -c model_reasoning_effort="xhigh"' --json ORCA terminal wait --terminal <handle> --for tui-idle --timeout-ms 60000 --json ORCA terminal send --terminal <handle> --text "<task brief>" --enter --json ``` ``` From `send.md:76-80`: ```bash ```bash ORCA terminal read --terminal <handle> --json ORCA terminal wait --terminal <handle> --for tui-idle --timeout-ms 300000 --json ORCA terminal send --terminal <handle> --text "<message>" --enter --json ``` ``` ### Technical Analysis The Skill instructs an Agent to substitute task names, task briefs, messages, terminal handles, worktree paths, and agent identifiers directly into shell command templates. Free-form prompt text is placed inside double quotes, while some other dynamic values are not quoted at all. Double quotes in the template do not safely handle text that itself contains an unescaped double quote. Because an Agent commonly constructs the final Bash command by replacing placeholders before invoking the Bash tool, malicious text can terminate the intended quoted argument and introduce shell operators or additional commands. For example, if a task brief is rendered into the template as: ```text "; touch /tmp/orca-injected; # ``` the resulting command can become: ```bash orca terminal send --terminal term_123 --text ""; touch /tmp/orca-injected; #" --ente ...[truncated 1846 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not construct Bash command strings by directly substituting user-controlled text. 2. Invoke the Orca executable through an API that accepts an argument array, keeping each dynamic value as a distinct argument. 3. If execution must pass through Bash, encode every dynamic argument with a proven shell-escaping mechanism such as `printf '%q'`; do not implement ad hoc quote replacement. 4. Prefer Orca options that accept prompt content through stdin, a file descriptor, or a JSON request file when available. 5. Validate structured identifiers separately: - Restrict terminal handles and repository IDs to their documented formats. - Restrict agent names to Orca's supported allowlist. - Validate worktree selectors returned by the Orca CLI before reuse. 6. Update the documentation with an explicit warning that placeholders are argument values, not raw shell fragments. 7. Add regression tests containing double quotes, semicolons, newlines, backticks, command substitutions, and redirection characters in task names and prompts. 8. Confirm the current Orca CLI interface before selecting an input mechanism, as required by the Skill's own command-source-of-truth policy. ]]>