T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:43- Finding
Shell Command Injection Through Unquoted Get Note URL Substitution
- Content
View full analysis
``` `references/url-types.md:24`: ```bash node skills/anylink-to-note/scripts/getnote.js ``` ### Technical Analysis The Skill instructs an agent or user to substitute an externally supplied URL directly into an unquoted shell command. If the value contains shell control operators, command substitution, redirection, or whitespace, the shell can interpret those characters as syntax rather than as part of a single URL argument. Although `scripts/getnote.js` itself reads the URL through `process.argv[2]`, that protection occurs only after the shell has parsed the command. It therefore does not prevent command injection introduced by unsafe command construction. ### Attack Path 1. An attacker supplies a purported Get Note link containing shell metacharacters, such as a command separator followed by an attacker-selected command. 2. The Skill replaces the `` placeholder with the supplied text. 3. The generated command is passed to a shell. 4. The shell interprets the metacharacters and executes the injected command in addition to, or instead of, invoking `getnote.js`. 5. The injected command runs with the operating-system permissions of the user or agent executing the Skill. ### Impact Assessment Successful exploitation permits arbitrary local command execution. The attacker may read files accessible to the agent, access environment variables and locally stored credentials, alter project data, make network requests, install additional payloads, or otherwise act with the full privileges of the Skill process. ]]>- Remediation
View remediation