T09 · Insecure Skill Coding Practices
- Location
SKILL.md:52- Finding
Insufficient validation of user-controlled ticker values may enable shell command injection
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 52–54 and 112–121
Vulnerability Type: Shell command injection through unsafe interpolation of a user-controlled path parameter
Risk Level: HighVulnerable Code
markdown Example: ```bash curl -s "https://data912.com/historical/stocks/GGAL" | jq '.[0:10]'text ```markdown 2. **Validate required input**: - For historical/EOD endpoints, require a ticker symbol. - If ticker is missing, ask for it before querying. 3. **Fetch data with `curl -s`** and parse with `jq`.Technical Analysis
The skill instructs the agent to accept a ticker supplied by the user, place it in an endpoint path, and retrieve that endpoint using a shell-based
curlcommand. The documented validation only verifies that a ticker is present. It does not impose a strict character allowlist, enforce a maximum length, or require URL encoding.If an implementation follows the documented example by directly interpolating the supplied ticker into a shell command, shell syntax embedded in the ticker can be evaluated locally. Double-quoting the URL is not sufficient protection because command substitution constructs such as
$(...)and backticks remain active inside double quotes.For example, an attacker could provide a ticker conceptually shaped like:
text $(ATTACKER_CONTROLLED_COMMAND)A vulnerable interpolation would produce:
bash curl -s "https://data912.com/historical/stocks/$(ATTACKER_CONTROLLED_COMMAND)" | jq '.[0:10]'The shell would execute the substituted command before invoking
curl. The project does not contain an implementation script proving that interpolation occurs automatically, so exploitation depends on the invoking agent or integration constructing commands from the instructions in this unsafe manner. Nevertheless, the documented workflow establishes an unsafe command-construction pattern without the necessary ...[truncated 1436 chars]- Remediation
View remediation
Remediation Suggestions
-
Enforce a strict ticker allowlist before constructing any request. For example:
text ^[A-Za-z0-9.-]{1,20}$Reject values containing whitespace, shell metacharacters, slashes, quotes, backticks, dollar signs, control characters, or encoded path separators.
-
Normalize accepted symbols to the expected case and, where practical, verify them against the ticker lists published by the API specification.
-
Avoid constructing shell command strings. Use an HTTP client or tool interface that accepts the URL and path components as structured arguments without shell evaluation.
-
URL-encode the validated ticker as an individual path segment. URL encoding should supplement, not replace, strict allowlist validation.
-
If shell execution is unavoidable, pass arguments as a fixed argument array rather than evaluating a dynamically assembled command. Do not use
eval,sh -c, or equivalent command-string execution. -
Update the workflow documentation to explicitly require validation before any network call. A safer instruction would be:
markdown Accept tickers only when they match `^[A-Za-z0-9.-]{1,20}$`. Reject all other values. URL-encode the validated ticker as one path segment and invoke the HTTP client without a shell-interpreted command. -
Add negative tests covering command substitutions, quotes, semicolons, pipes, redirects, newlines, traversal sequences, and oversized ticker values.
-