T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:138
- Finding
- Shell Command Injection Through Unsafe Placeholder Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:138-142`, `SKILL.md:182-188`, `SKILL.md:251-255`, and `SKILL.md:271-274` **Vulnerability Type**: Shell command injection through user-controlled or model-generated command arguments **Risk Level**: High ### Vulnerable Code `SKILL.md:138-142`: ```bash python3 scripts/save_draft.py \ --subreddit "{chosen_subreddit}" \ --angle "{A|B|C}" \ --title "{title}" \ --body "{body}" ``` `SKILL.md:182-188`: ```bash python3 scripts/update_subreddit_profile.py \ --subreddit "r/example" \ --subscribers 50000 \ --activity "high" \ --promo_rules "ok with transparency" \ --best_angle "story" \ --notes "Loves failure stories and specific numbers" ``` `SKILL.md:251-255`: ```bash python3 scripts/init_config.py \ --name "{product_name}" \ --description "{description}" \ --target_user "{target}" \ --stage "{stage}" ``` `SKILL.md:271-274`: ```bash python3 scripts/log_post.py \ --url "https://reddit.com/r/.../comments/..." \ --angle "{A|B|C}" \ --draft_file "memory/drafts/YYYY-MM-DD-subreddit.md" ``` ### Technical Analysis The Skill instructs an agent with Bash access to substitute product details, Reddit post content, subreddit information, and URLs directly into shell command templates. Double quotes do not make arbitrary input safe for shell execution. Shell constructs such as command substitutions using `$()` or backticks are evaluated even when they appear inside double-quoted arguments. An embedded double quote can also terminate the intended argument and introduce shell operators. For example, if a product description is supplied as: ```text $(malicious_command) ``` the resulting setup command would contain: ```bash --description "$(malicious_command)" ``` Bash would execute `malicious_command` before invoking the Python script. Input containing a closing quote and shell operators could similarly alter the command structure. The affected values can originate from us ...[truncated 2154 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Avoid shell-based interpolation entirely.** Invoke scripts through a structured process-execution API that accepts an argument array and does not invoke a shell. Each value should be passed as one literal argument. 2. **Use standard input or structured files for free-form content.** Post bodies, titles, descriptions, and notes should be serialized as JSON or written to a securely created temporary file and then supplied to the script through stdin or a file argument. 3. **Apply strict validation by field type.** - Restrict subreddit names to an allowlist pattern such as `^[A-Za-z0-9_]{2,21}$`. - Restrict angles and stages to documented enum values. - Validate Reddit URLs with a URL parser and allow only expected HTTPS Reddit hostnames. - Enforce reasonable length limits on titles, descriptions, notes, and post bodies. 4. **If shell execution cannot be avoided, use robust argument escaping.** Apply a proven shell-quoting routine to every dynamic value rather than relying on surrounding double quotes. Do not construct a command by string concatenation. 5. **Document safe execution explicitly.** Replace executable Bash templates containing placeholders with non-shell pseudocode or instructions that require argument-array invocation. 6. **Include and audit the referenced scripts.** The package currently contains only `SKILL.md`; the scripts named by the workflows are unavailable for review. Their source should be included and tested for input validation, path traversal, unsafe subprocess invocation, and insecure file handling. 7. **Add regression tests.** Test values containing double quotes, single quotes, spaces, newlines, semicolons, `$()`, backticks, redirection operators, and Unicode characters. Verify that these values are stored as literal data and never interpreted by a shell. ]]>