T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:36
- Finding
- Potential Shell Command Injection Through Unsafely Interpolated User Input<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 36–47 and 91–94 **Vulnerability Type**: Shell command injection caused by unsafe command construction guidance **Risk Level**: High ### Vulnerable Snippets ```markdown Use the `life-state` CLI via Bash. YAML output to stdout. ### Capture state (merge semantics — only updates the fields you pass) ```bash life-state set --mood tired --energy 4 --sore chest,triceps --sleep poor --note "headache, late night" ``` Flags (all optional, at least one required): - `--mood <m>` — `great | good | normal | tired | terrible` (freeform accepted; lowercased) - `--energy <n>` — 1-10 (rejected outside that range) ``` The instructions later explicitly direct the agent to derive free-form command arguments from natural-language input: ```markdown - **Parse loosely from natural language.** "feeling tired, energy 4" → `--mood tired --energy 4`. "sore chest and triceps" → `--sore chest,triceps`. - **Merge, don't replace.** If user adds "energy 6 now" later in the day, only update `--energy`. Don't wipe morning mood. - **Recommend the enum values** when you summarize back, but accept freeform — if a user says "drained" or "wired," store it verbatim; downstream skills can pattern-match or pass-through. ``` ### Technical Analysis The Skill instructs an agent to invoke the `life-state` CLI through Bash while deriving arguments from user-controlled natural-language input. Several arguments, including `--mood`, `--sleep`, `--sore`, and `--note`, can contain free-form text. The documentation does not require structured process invocation, argument arrays, validation, or shell-safe escaping. If an implementing agent constructs a command by directly substituting a user value into the documented Bash command, quotation marks, command substitutions, or shell metacharacters in that value can terminate the intended argument and introduce additional shell operations. For example, a malicious note containing syntax ...[truncated 2302 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Avoid shell-based interpolation.** Invoke `life-state` through a process API that accepts an executable and an argument array, for example: ```text executable: life-state arguments: ["set", "--note", userNote] ``` The agent should not assemble a single command string interpreted by Bash. 2. **Document a mandatory safe invocation rule.** Explicitly state that values derived from natural language must never be concatenated into a shell command. 3. **Validate constrained fields.** - Require `energy` to match an integer from 1 through 10. - Prefer strict allowlists for mood and sleep values. - Validate dates against an exact `YYYY-MM-DD` pattern and reject invalid calendar dates. - Normalize soreness values using an expected character set and length limit. 4. **Bound free-form fields.** Apply reasonable size limits to notes and reject control characters. Free-form text should remain an opaque argument and must not be evaluated as shell syntax. 5. **Use end-of-options handling where supported.** Place `--` before positional user data when the CLI supports it. This is supplemental hardening and is not a replacement for argument-array invocation. 6. **Add adversarial tests.** Verify safe handling of embedded quotes, semicolons, backticks, newlines, dollar-sign substitutions, redirection operators, pipes, ampersands, and values beginning with hyphens. 7. **Clarify the trust boundary.** Warn that mood and health-state descriptions may originate from untrusted conversation content and must be treated strictly as data. ]]>