T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:69- Finding
Shell Command Injection Through Transaction JSON Interpolation
- Content
View full analysis
' ``` Where `` is a JSON object with the transaction fields. For multiple transactions, wrap them in a `transactions` array: ```bash node pocket-lens.mjs create-transaction '{"transactions": [{"merchant": "스타벅스", "amount": 5500, "date": "2025-12-05T14:30:00+09:00", "cardName": "신한카드", "categoryHint": "카페"}]}' ``` ### Technical Analysis The Skill instructs the Agent to insert transaction JSON directly into a single-quoted shell command. Transaction fields originate from untrusted sources, including user messages and text extracted from receipts, card statements, banking screenshots, and other images. A single quote within a merchant name, description, card name, or other extracted field can terminate the shell argument. Additional shell syntax can then be interpreted before Node.js starts. The `JSON.parse` call in `scripts/pocket-lens.mjs` does not mitigate this issue because shell parsing occurs before the JSON reaches the script. For example, if attacker-controlled text is inserted into the command without safe argument handling, a value containing a sequence conceptually similar to: ```text '; attacker_command; # ``` could terminate the JSON argument and append a separate shell command. Exploitation depends on the Agent executing the documented command through a shell, as the Skill explicitly demonstrates with Bash-style syntax. ### Attack Path 1. An attacker supplies a crafted transaction description, merchant name, or receipt image containing shell metacharacters and a single quote. 2. The image or message is processed, and the malicious text is preserved in a transaction field. 3. The Agent follows `SKILL.md` and interpolates the resulting JSON into the documented si ...[truncated 959 chars]- Remediation
View remediation