T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:41- Finding
Shell Command Injection Through Unquoted User-Controlled File Paths
- Content
View full analysis
--chart-type [--output ] [--usl ] [--lsl ] ``` ``` The same unsafe invocation requirement is reiterated at lines 78–79: ```markdown - **Script invocation method**: The script must be invoked with the `exec_shell` tool, using `/workspace/projects/spc-analysis` as the working directory. - **Command format**: `python scripts/spc_analysis.py --input --chart-type [--output ] [--usl ] [--lsl ]` ``` ### Technical Analysis The Skill explicitly instructs the Agent to construct a shell command by substituting paths into an `exec_shell` command. The dynamic `--input` and `--output` arguments are not quoted or otherwise safely encoded. File paths can contain shell metacharacters such as semicolons, command substitutions, redirection operators, or newlines. If an attacker controls an uploaded filename or persuades the Agent to use a crafted path, the shell can parse part of that path as a separate command. For example, unsafe interpolation of a path resembling the following would introduce a second command: ```text data.xlsx; id > /tmp/spc-command-injection-proof # ``` The resulting shell command would be interpreted approximately as: ```bash python scripts/spc_analysis.py --input data.xlsx; id > /tmp/spc-command-injection-proof # --chart-type imr ``` This issue exists in the Skill’s required execution workflow rather than in `argparse` inside the Python script. Once the shell has parsed the command line, Python-side argument validation cannot prevent execution of the injected com ...[truncated 1594 chars]- Remediation
View remediation