T09 · Insecure Skill Coding Practices
Error
- Location
scripts/handler.sh:283- Finding
Bash Arithmetic Expression Injection Through Unvalidated Navigation Inputs
- Content
View full analysis
- Remediation
View remediation
= 1 && t <= 10 )) || { echo '{"status":"error","message":"Session must be from 1 to 10"}' exit 1 } ``` Apply equivalent validation to phase numbers and callback suffixes. Validate the callback before invoking another process: ```bash life:session:*) t="${1##life:session:}" [[ "$t" =~ ^[0-9]+$ ]] && (( t >= 1 && t <= 10 )) || { echo '{"status":"error","message":"Invalid session callback"}' exit 1 } release_lock exec "$0" session "$t" "$WORKSPACE" ;; ``` Avoid interpolating input into `jq` source code. Pass normalized values through typed arguments: ```bash upd_session() { local session="$1" local tmp tmp=$(mktemp) jq --argjson session "$session" \ '.currentSession = $session | .currentPhase = 1' \ "$STATE_FILE" > "$tmp" && mv "$tmp" "$STATE_FILE" } ``` Additional hardening should include: 1. Validate all reminder time components before arithmetic evaluation. 2. Reject signs, whitespace, array syntax, variable names, operators, and leading non-decimal content. 3. Add regression tests using malformed arithmetic expressions and forged callback values. 4. Run the Skill under a restricted operating-system account or sandbox to limit the consequences of future command-injection defects. ]]>