T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:65- Finding
Command Injection Through an Unquoted Project Path
- Content
View full analysis
'"'"' && python skills/war-room/monitor.py --project "' # Linux xterm -title "War Room Monitor" -e "python skills/war-room/monitor.py --project " & ``` ### Technical Analysis The playbook instructs the agent to replace `` with an active project directory and then embed the resulting value directly into command text. The project path is not safely quoted or passed as a discrete process argument. On Linux, shell metacharacters contained in the substituted path may be interpreted by the shell involved in launching the terminal command. The macOS variant is additionally embedded inside AppleScript and shell command strings, creating multiple parsing contexts that require separate escaping. If an attacker can influence the active project path, a value containing characters such as command separators, substitutions, or quotes may alter the intended command and append arbitrary operating-system commands. Merely checking that the resulting path exists would not make shell-string interpolation safe. ### Attack Path 1. An attacker supplies, creates, or convinces the user to open a project under a directory name containing shell syntax. 2. The war-room skill follows its setup instructions and substitutes that path for ``. 3. The resulting monitor-launch command is submitted to `xterm`, AppleScript, or a shell without context-appropriate escaping. 4. The command interpreter treats part of the path as executable syntax rather than as a single path argument. 5. The injected command runs with the same operating-system privileges and environment access as the user running the agent. Exploitation requires influence over the selected project path and execution ...[truncated 518 chars]- Remediation
View remediation