T09 · Insecure Skill Coding Practices
Error
- Location
- references/curl_heredoc.md:17
- Finding
- Arbitrary Command Execution Through Unsafe Bash Template Substitution<![CDATA[ ## Vulnerability Details **File Location**: `references/curl_heredoc.md`, lines 17–30 and 90–100 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code Lines 17–30: ```bash API_KEY="<API_KEY>" RAW_OUT="<OUTPUT_FILE>" # CRITICAL: Sanitize filename to prevent shell injection OUT_FILE=$(echo "$RAW_OUT" | tr -cd 'A-Za-z0-9._-') # Ensure it has a valid extension if [[ ! "$OUT_FILE" =~ \.(webp|png|jpg|jpeg)$ ]]; then OUT_FILE="${OUT_FILE}.webp" fi # Ensure it's not empty if [ -z "$OUT_FILE" ]; then OUT_FILE="evolink-$(date +%s).webp" fi PROMPT="<USER_PROMPT>" ``` Lines 90–100: ```bash RAW_OUT="<OUTPUT_FILE>" # CRITICAL: Sanitize filename OUT_FILE=$(echo "$RAW_OUT" | tr -cd 'A-Za-z0-9._-') if [[ ! "$OUT_FILE" =~ \.(webp|png|jpg|jpeg)$ ]]; then OUT_FILE="${OUT_FILE}.webp" fi if [ -z "$OUT_FILE" ]; then OUT_FILE="evolink-result.webp" fi curl -L -o "$OUT_FILE" "<URL>" ``` ### Technical Analysis The reference instructs the caller to replace placeholders such as `<USER_PROMPT>`, `<OUTPUT_FILE>`, `<API_KEY>`, and `<URL>` directly in executable Bash source. Double quotes prevent word splitting and pathname expansion, but they do not prevent command substitution. If a substituted value contains `$(...)` or backtick syntax, Bash executes it while evaluating the assignment or command. The output filename is sanitized only after Bash has evaluated: ```bash RAW_OUT="<OUTPUT_FILE>" ``` Consequently, commands embedded in the replacement value execute before `tr` removes shell metacharacters. The same issue applies directly to `PROMPT="<USER_PROMPT>"`, the API-key assignment, and the literal URL template. The later `json_escape` function does not mitigate this issue because the prompt has already been parsed and command substitutions have already executed by the time the function receives it. ### Attack Path 1. An attacker supplies an image-generation prompt containing shell command-substitution syntax, for example: ...[truncated 1624 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Do not insert untrusted values into shell source code.** Replace textual placeholder substitution with positional parameters: ```bash API_KEY=$1 PROMPT=$2 SIZE=$3 NSFW_CHECK=$4 RAW_OUT=$5 ``` Invoke the script through an execution interface that supplies each value as a distinct argument rather than constructing a shell command string. 2. **Prefer the Python or PowerShell reference implementation.** Both use structured argument parsing and JSON serialization instead of embedding the prompt into executable source. 3. **Use a real JSON serializer.** Pass values to Python, `jq`, or another structured encoder rather than maintaining a custom shell escaping routine. For example: ```bash PAYLOAD=$(python3 -c ' import json, sys print(json.dumps({ "model": "z-image-turbo", "prompt": sys.argv[1], "size": sys.argv[2], "nsfw_check": sys.argv[3].lower() == "true" })) ' "$PROMPT" "$SIZE" "$NSFW_CHECK") ``` 4. **Validate output paths before use.** Accept only a basename with an approved image extension, reject path separators, and create the output in a predetermined directory. Sanitization should operate on data received through arguments or environment variables, not on text inserted into source. 5. **Validate result URLs structurally.** Require HTTPS and, where the service contract permits, restrict downloads to documented EvoLink or trusted storage hosts. Do not place a URL directly into generated shell source. 6. **Remove the standalone literal-substitution example.** Replace: ```bash curl -L -o "$OUT_FILE" "<URL>" ``` with an argument-based form such as: ```bash URL=$1 curl --fail --location --output "$OUT_FILE" "$URL" ``` 7. **Avoid command-string execution mechanisms.** Do not pass constructed values to `eval`, `bash -c`, or similar interfaces. Ensure the Agent invokes the script using an argument array whenever supported. ...[truncated 4 chars]