T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:157
- Finding
- Shell Command Injection Through Unquoted User-Controlled File Paths<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 157–159 **Vulnerability Type**: Shell command injection and argument injection **Risk Level**: High ### Vulnerable Code ```text 3. Run `northbase get <path>` to read a file. 4. Modify the content if needed. 5. Run `northbase put <path>` to update or create the file. ``` ### Technical Analysis The skill directs the agent to substitute a user-provided file path directly into a shell command. It does not require shell-safe quoting, path validation, an end-of-options delimiter, or execution through a shell-free argument array. Because users can explicitly reference filenames when invoking the skill, the `<path>` value may be attacker-controlled. If the agent constructs and executes the documented command through a shell, metacharacters such as semicolons, command substitutions, redirection operators, or pipelines may be interpreted as shell syntax rather than as part of the filename. Paths beginning with `-` may also be parsed as command-line options by the Northbase CLI, potentially altering its behavior even when shell metacharacters are unavailable. ### Attack Path 1. An attacker asks the agent to read or update a purported note with a crafted path, such as: ```text notes.md; id > /tmp/northbase-proof ``` 2. The agent follows the documented template and constructs: ```sh northbase get notes.md; id > /tmp/northbase-proof ``` 3. If executed through a command shell, the shell treats the semicolon as a command separator. 4. The Northbase command runs first, followed by the injected operating-system command. 5. The injected command executes with the same operating-system identity, filesystem permissions, environment variables, and accessible credentials as the agent process. The same issue applies to `northbase put <path>`. In that case, attacker-controlled content may also be piped through standard input while the crafted path injects an additional command. ### ...[truncated 774 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Avoid shell interpolation.** Invoke Northbase through a process API that accepts an argument array, for example conceptually: ```text executable: northbase arguments: ["get", validatedPath] ``` 2. **Require strict path validation.** Permit only workspace-relative paths and reject: - Absolute paths. - Empty paths. - `.` or `..` traversal components. - NUL bytes and control characters. - Shell metacharacters. - Paths beginning with `-`, unless safely handled by the CLI. - Paths outside the intended Northbase workspace namespace. 3. **Use an end-of-options delimiter where supported:** ```sh northbase get -- "$path" northbase put -- "$path" ``` Quoting alone protects against shell tokenization, while `--` also prevents option injection. Shell-free execution remains preferable. 4. **Update the skill instructions** to explicitly prohibit concatenating user input into shell command strings and to mandate validation before every `pull`, `list`, `get`, or `put` operation involving a user-supplied prefix or path. 5. **Apply least privilege and sandboxing.** Run the CLI with only the filesystem and network access required for Northbase operations so that any remaining command-execution flaw has limited impact. ]]>