T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:101- Finding
Shell Command Injection Through Unsafe HTML Interpolation
- Content
View full analysis
"}' ``` ```bash curl -X PUT https://gui.new/api/canvas/abc123xyz \ -H 'Content-Type: application/json' \ -H 'Authorization: Bearer tok_...' \ -d '{"html": ""}' ``` ### Technical Analysis The skill instructs the agent to insert generated HTML directly into a single-quoted shell argument passed to `curl`. Generated project content can be influenced by the user and can legitimately contain apostrophes, quotation marks, backslashes, newlines, or shell metacharacters. JSON escaping does not provide shell escaping. If inserted HTML contains a single quote, it terminates the shell's quoted `-d` argument. Subsequent shell metacharacters may then be parsed as commands or command separators rather than as HTML data. Even non-malicious apostrophes can corrupt the JSON payload and cause publishing failures. The same unsafe construction is documented for both canvas creation and canvas updates. The update request additionally uses an authorization token in the same shell process, increasing the sensitivity of successful command injection. ### Attack Path 1. An attacker supplies project text or a requested title containing a crafted single quote followed by shell syntax. 2. The agent incorporates that attacker-controlled text into the generated HTML. 3. The generated HTML is substituted for `` or `` in the documented command. 4. The crafted single quote closes the surrounding shell argument. 5. The shell interprets the remaining metacharacters and text as additional shell operations. 6. Those operations execute with the same opera ...[truncated 1160 chars]- Remediation
View remediation
payload.json curl --fail-with-body \ -X POST 'https://gui.new/api/canvas' \ -H 'Content-Type: application/json' \ --data-binary @payload.json ``` For updates: ```bash jq -n --arg html "$HTML" '{html: $html}' > payload.json curl --fail-with-body \ -X PUT "https://gui.new/api/canvas/$CANVAS_ID" \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $EDIT_TOKEN" \ --data-binary @payload.json ``` 4. **Avoid invoking a command through a shell.** Execute `curl` with an argument array, or use an SDK, so shell metacharacters are never interpreted. 5. **Validate identifiers separately.** Restrict canvas IDs to the documented character set before placing them in a URL. 6. **Protect edit tokens.** Keep tokens in memory where possible, avoid logging them, redact them from errors, and never embed them in generated project files. 7. **Apply defense in depth.** Run the agent as an unprivileged account with filesystem and outbound-network restrictions independently enforced by the runtime. 8. **Add regression tests** using HTML containing apostrophes, quotes, backslashes, newlines, command substitutions, and shell separators. Verify that the content is published literally and that no additional process is executed. ]]>