T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:72
- Finding
- Shell Injection Through the Recommended Standard-Input Invocation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:72-75` **Vulnerability Type**: Shell command injection through unsafe code interpolation **Risk Level**: High ### Vulnerable Code ```bash **Recommended Method (stdin):** ```bash echo "<code>" | node scripts/run-code.cjs <languageId> ``` ``` ### Technical Analysis The recommended command places potentially untrusted source code inside a double-quoted shell argument. Double quotes do not prevent shell evaluation of command substitutions, variable expansion, or backticks. For example, source text containing `$(command)` is evaluated by the caller's shell before `echo` sends data to the runner. Consequently, malicious shell syntax can execute outside `run-code.cjs`. This bypasses the runner's timeout, output handling, temporary-file cleanup, and language-selection logic. The documentation's assertion that this method avoids escaping issues is therefore unsafe. ### Attack Path 1. An attacker supplies a code snippet containing shell substitution syntax such as `$(malicious-command)`. 2. An AI Agent follows the documented invocation and interpolates the snippet into `echo "<code>"`. 3. The Agent's shell evaluates the substitution before starting or feeding the code runner. 4. The substituted command executes directly with the Agent process's operating-system privileges. 5. Only the resulting text is passed to `run-code.cjs`, potentially concealing the prior shell-side execution. ### Impact Assessment Successful exploitation permits arbitrary command execution as the account running the Agent. The attacker can access any files, environment variables, credentials, network resources, and processes available to that account. Because execution occurs outside the runner, its timeout and cleanup behavior do not constrain the injected command. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not interpolate source code into an `echo` command or any shell command string. - Invoke the Node.js process through an argument-array API such as `spawn()` with `shell: false`, and write the exact source bytes to the child process's stdin. - If a shell example is unavoidable, use a strongly quoted heredoc with a fixed delimiter: ```bash node scripts/run-code.cjs javascript <<'CODE_RUNNER_EOF' console.log("Example"); CODE_RUNNER_EOF ``` - Clearly state that dynamically inserting untrusted content into shell command text is prohibited. - Add regression tests containing `$()`, backticks, dollar signs, backslashes, quotes, and multiline content to verify that input reaches the runner unchanged. ]]>