T09 · Insecure Skill Coding Practices
Error
- Location
lib/frame-extractor.js:29- Finding
Shell Command Injection Through Untrusted Paths and URLs
- Content
View full analysis
{ const cmd = `ffmpeg -i "${videoPath}" -vn -acodec pcm_s16le -ac 1 -ar 16000 -y "${finalAudioPath}"`; exec(cmd, (error) => { if (error) reject(error); else resolve(finalAudioPath); }); }); const getDurationCmd = `ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 "${audioPath}"`; const duration = await new Promise((resolve) => { exec(getDurationCmd, (err, stdout) => resolve(parseFloat(stdout) || 0)); }); const cutCmd = `ffmpeg -ss ${startTime} -t ${SEGMENT_DURATION} -i "${audioPath}" -acodec copy -y "${segmentPath}"`; exec(cutCmd, (err) => err ? reject(err) : resolve()); ``` ```js // lib/video-downloader.js const command = `yt-dlp -o "${outputPath}" --no-warnings "${videoUrl}" 2>&1`; const { stdout, stderr } = await execAsync(command, { timeout: 120000 }); ``` ### Technical Analysis The Skill constructs shell command strings by interpolating local file paths, generated output paths, and browser-derived media URLs, then invokes them through `child_process.exec`. This API executes commands through a system shell. Wrapping a value in double quotes does not make it safe for shell execution. An input containing an embedded quote can terminate the quoted argum ...[truncated 1498 chars]- Remediation
View remediation