T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:10
- Finding
- Unquoted File Paths May Enable Shell Command or Option Injection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 10 **Vulnerability Type**: Shell command injection and argument injection **Risk Level**: Medium ### Vulnerable Code ```sh cp [inbound image] notes/screenshots/[descriptive-name].jpg ``` ### Technical Analysis The documented copy command uses placeholders for the inbound image path and descriptive destination name without requiring shell-safe quoting, validation, or an end-of-options delimiter. If an agent implementation directly interpolates attacker-controlled or model-generated values into this command, the shell may interpret whitespace, metacharacters, command substitutions, redirections, or leading hyphens rather than treating the values exclusively as file paths. For example, an inbound filename containing shell syntax could execute additional commands when inserted into a shell command. A source path beginning with `-` could also be interpreted as a `cp` option. The destination name is model-generated from screenshot content and therefore should likewise be treated as untrusted until normalized. Exploitation depends on the workflow executing this template through a shell with direct string interpolation. Structured process invocation that passes arguments separately would prevent shell metacharacter interpretation. ### Attack Path 1. An attacker provides a screenshot whose inbound filename or associated naming context contains crafted shell syntax, whitespace, command substitution, or a leading option marker. 2. The agent derives the source or destination path and substitutes it directly into the documented `cp` command. 3. The agent executes the resulting command through a shell without quoting, validation, or `--`. 4. The shell interprets the crafted content as syntax or additional arguments. 5. Commands may execute, or files may be copied to or overwritten at unintended locations, with the privileges of the agent process. ### Impact Assessment Successful exploitation co ...[truncated 571 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer a structured filesystem API or process-execution API that passes the source and destination as separate arguments without invoking a shell. 2. If shell execution is unavoidable, use an end-of-options delimiter and quote both paths: ```sh cp -- "$source_path" "$destination_path" ``` 3. Do not construct either path by directly concatenating untrusted screenshot content, comments, filenames, or model output. 4. Generate destination names from a strict allowlist, such as lowercase ASCII letters, digits, and hyphens. Reject or replace path separators, control characters, shell metacharacters, leading hyphens, `.` segments, and `..` segments. 5. Resolve and canonicalize both paths before copying. Verify that the source belongs to the approved inbound directory and that the destination remains within `notes/screenshots`. 6. Prevent unintended overwrites by generating unique filenames or using no-clobber behavior where appropriate. 7. Run the workflow with least privilege and restrict its filesystem access to the inbound-image and notes directories. ]]>