T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:72- Finding
Shell Injection Through the Recommended Standard-Input Invocation
- Content
View full analysis
" | node scripts/run-code.cjs ``` ``` ### Technical Analysis The recommended command places potentially untrusted source code inside a double-quoted shell argument. Double quotes do not prevent shell evaluation of command substitutions, variable expansion, or backticks. For example, source text containing `$(command)` is evaluated by the caller's shell before `echo` sends data to the runner. Consequently, malicious shell syntax can execute outside `run-code.cjs`. This bypasses the runner's timeout, output handling, temporary-file cleanup, and language-selection logic. The documentation's assertion that this method avoids escaping issues is therefore unsafe. ### Attack Path 1. An attacker supplies a code snippet containing shell substitution syntax such as `$(malicious-command)`. 2. An AI Agent follows the documented invocation and interpolates the snippet into `echo ""`. 3. The Agent's shell evaluates the substitution before starting or feeding the code runner. 4. The substituted command executes directly with the Agent process's operating-system privileges. 5. Only the resulting text is passed to `run-code.cjs`, potentially concealing the prior shell-side execution. ### Impact Assessment Successful exploitation permits arbitrary command execution as the account running the Agent. The attacker can access any files, environment variables, credentials, network resources, and processes available to that account. Because execution occurs outside the runner, its timeout and cleanup behavior do not constrain the injected command. ]]>- Remediation
View remediation