T09 · Insecure Skill Coding Practices
Error
- Location
scripts/api_client.py:57- Finding
Shell Command Injection Through an Unquoted Skill Directory
- Content
View full analysis
{log_file} 2>&1 & echo $! > {pid_file} """ subprocess.Popen(cmd, shell=True, executable='/bin/bash') ``` ### Technical Analysis The `skill_dir` value is inserted directly into a multiline Bash command without shell quoting. The resulting string is then passed to `subprocess.Popen()` with `shell=True`. Although `skill_dir` is normally derived from the location of `api_client.py`, filesystem paths can contain spaces, command separators, command substitutions, newlines, and other shell metacharacters. If the project is installed or copied under an attacker-controlled path, Bash interprets those characters as syntax rather than as part of a directory name. For example, a directory component containing a command substitution such as `$(malicious-command)` would be evaluated when the generated `cd` line is parsed. The use of an argument list elsewhere in the application does not mitigate this call because the entire command is explicitly delegated to Bash. Automatic server startup is useful for the declared transcription functionality, but execution through an interpolated shell exceeds the minimum mechanism required. Python can start the server directly with a controlled working directory and environment. ### Attack Path 1. An attacker distributes, extracts, relocates, or causes the Skill to be installed under a directory whose name contains shell metacharacters. 2. A user runs: ```bash python scripts/api_c ...[truncated 911 chars]- Remediation
View remediation