T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:107- Finding
Agent Shell Guidance Can Cause Command Injection Through Untrusted Input
- Content
View full analysis
`: ```text python scripts/detect.py --json ``` However, the CLI defines the positional argument as a file path: ```python parser.add_argument( "input", nargs="?", help="Input file path (reads from stdin if omitted)" ) ``` It subsequently reads that argument as a file: ```python if args.input: try: text = read_file(args.input) return text, args.input ``` ### Technical Analysis The Skill directs an Agent with Shell permission to place user-controlled text directly into a shell command. It does not require quoting, escaping, stdin transport, an argument-array API, or `shell=False`. If an Agent follows this instruction by constructing a command string, shell metacharacters contained in the supplied text can be interpreted by the shell rather than passed as literal text. Relevant metacharacters include command substitutions, separators, redirections, and pipelines. There is also a functional mismatch: `scripts/detect.py` expects its positional argument to be a file path, not raw text. Consequently, ordinary input may fail as a nonexistent filename, while malicious input can become shell syntax before the Python process receives it. Exploitation depends on the hosting Agent implementing the instruction through an actual shell and interpolating the input without safe argument handling. ### Attack Path 1. An attacker submits text for analysis or rewriting through a trigger supported by the Skill. 2. The tex ...[truncated 1032 chars]- Remediation
View remediation