T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:31- Finding
Unrestricted Remote Shell Command Execution
- Content
View full analysis
"]` - Use `cwd`: `~/git` (or the last known working directory if changed). - Report the output directly. ``` ### Technical Analysis The skill instructs the agent to pass all text following the `!` prefix directly to `bash -c` on a remote node. No command allowlist, argument validation, privilege restriction, path confinement, confirmation step, or protection against destructive operations is specified. Because `bash -c` interprets shell syntax, a user can execute pipelines, substitutions, redirections, chained commands, scripts, and arbitrary programs available to the remote account. The declared `nodes` permission supplies the execution channel, while the command's effective privileges are those of the remote node agent. Although direct Bash access is documented as a feature, unrestricted shell execution materially exceeds the permissions required merely to proxy prompts to `oz-cli` and creates a high-impact unsafe execution path. ### Attack Path 1. The user activates Oz mode with `/oz`. 2. The user submits a message beginning with `!`. 3. The skill removes the prefix without validating the remaining content. 4. The content is supplied to `bash -c` through the remote `nodes` tool. 5. Bash interprets and executes the arbitrary command with the remote agent account's privileges. 6. A malicious command can read credentials, alter repositories, delete data, execute installed programs, or access other resources available to that account. ### Impact Assessment Successful expl ...[truncated 691 chars]- Remediation
View remediation