T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:8
- Finding
- Unrestricted Auto-Approved Agent Execution and Unsafe Task Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 8-15 **Vulnerability Type**: Unrestricted headless execution and potential command injection **Risk Level**: Medium ### Vulnerable Code ```yaml usage: - title: Run Cline headless command: cline -y "<TASK>" notes: | Use for coding, scaffolding, debugging, and multi-step plans. Keep prompts short and task-oriented. examples: - 'cline -y "Create hello.sh that prints date and uname -a."' - 'cline -y "Refactor this repo: add README and scripts folder."' ``` ### Technical Analysis The skill instructs the agent to invoke Cline with the `-y` option and an arbitrary task value. This option enables non-interactive, auto-approved operation. Consequently, commands and file modifications selected by Cline may proceed without per-operation user confirmation. The task placeholder is also embedded inside a shell-style command string: ```text cline -y "<TASK>" ``` No requirement is given to pass the task as a structured process argument or to escape shell metacharacters. If the skill framework substitutes untrusted task text into this string and executes it through a shell, a task containing quote characters or shell operators could terminate the intended argument and introduce additional commands. Whether this direct injection route is exploitable depends on how the host executes the command template, but the configuration does not establish a safe argument boundary. The separate safety statement instructing the agent to ask before destructive commands does not technically enforce a control and is weakened by the unconditional use of auto-approval. ### Attack Path 1. An attacker or untrusted repository content influences the task supplied to the skill. 2. The task is substituted into `cline -y "<TASK>"`. 3. One of the following execution paths occurs: - Cline interprets malicious instructions and selects unsafe commands or file modifications. - If the host uses a ...[truncated 979 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `-y` from the default invocation and require interactive approval for command execution, file modification, deletion, network access, and other consequential operations. 2. Pass task content directly as a structured process argument rather than constructing a shell command string. 3. If shell invocation cannot be avoided, apply robust platform-specific argument escaping and reject control characters, unmatched quotes, command substitutions, redirection operators, and command separators. 4. Restrict execution to the intended project workspace using filesystem sandboxing or an isolated container. 5. Run Cline under a least-privileged account with no unnecessary access to credentials, home-directory secrets, system paths, or privileged sockets. 6. Establish an explicit allowlist for any operations permitted in unattended mode. Require confirmation for deletions, permission changes, package installation, network retrieval, and commands outside the workspace. 7. Convert the documented “ask before destructive commands” rule into an enforceable technical control rather than relying solely on prompt compliance. ]]>