T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:71
- Finding
- Unvalidated User-Controlled Values in Shell Command Templates## Vulnerability Details **File Location**: `SKILL.md`, lines 71-74 **Vulnerability Type**: Command injection through unsafe command construction **Risk Level**: High ### Vulnerable Code ```markdown **Claim airtime for a user:** ``` node c:\Users\LOYAL\Documents\openairtime\scripts\airtime.js claim_airtime FID CLAIM_CODE PHONE_NUMBER ``` ``` ### Technical Analysis The documented workflow instructs the agent to collect a claim code and phone number from an untrusted Farcaster user and place those values, together with an FID, into a command-line template. The instructions do not require validation, escaping, or use of a shell-free process execution API. If the agent constructs this command as a string and executes it through a command shell, shell metacharacters embedded in `FID`, `CLAIM_CODE`, or `PHONE_NUMBER` may be interpreted as command syntax rather than literal argument data. Other command templates in the file similarly use unquoted cast hashes and FIDs. The repository does not include the invoked scripts or their calling implementation, so the exact execution API cannot be verified. Exploitability depends on whether the runtime uses a shell and whether an upstream layer performs validation. Nevertheless, the skill's documented construction is unsafe because it establishes no required input constraints. ### Attack Path 1. An attacker sends the Farcaster agent a crafted claim code, phone number, or other command parameter containing shell metacharacters. 2. The agent follows the skill workflow and substitutes the attacker-controlled value into the documented command template. 3. The resulting command is passed to a shell without strict validation or safe argument separation. 4. The shell interprets the injected syntax and executes an additional attacker-selected command. 5. The injected command runs with the operating-system privileges and filesystem access of the agent process. ### Impact Assessment Su ...[truncated 401 chars]
- Remediation
- ## Remediation Suggestions - Validate each parameter against a strict allowlist before invoking any process: - Require FIDs to contain digits only and enforce a reasonable length. - Require claim codes to match the exact expected pattern, such as `^AIR-[A-Z0-9]{3}-[A-Z0-9]{3}$`, if that reflects the actual format. - Normalize and validate Nigerian phone numbers against an explicitly supported numeric format. - Validate cast hashes using their exact canonical encoding and length. - Invoke Node.js through a shell-free API such as `spawn()` or `execFile()` with each value supplied as a separate argument. - Do not construct commands by concatenating user-controlled strings. - Reject unexpected whitespace, control characters, command operators, redirection symbols, and encoded variants before execution. - Apply equivalent validation inside `airtime.js`; caller-side validation alone is insufficient. - Run the agent under a dedicated, least-privileged operating-system account. - Record rejected requests and sensitive operations in an audit log without logging complete phone numbers, credentials, or reusable claim codes.