T09 · Insecure Skill Coding Practices
Note
- Location
scripts/generate_content.py:148- Finding
Unescaped User Input Permits Terminal Control-Sequence Injection
- Content
View full analysis
>> SHORT DESCRIPTION <<<\n") print(generate_short_description(name, tagline, supply)) print("\n>>> COLLECTION DESCRIPTION <<<\n") print(generate_collection_description(name, tagline, supply, price, theme)) print("\n>>> TWITTER THREAD <<<\n") print(generate_twitter_thread(name, tagline, supply, price, theme, twitter)) print("\n>>> DISCORD WELCOME MESSAGE <<<\n") print(generate_discord_welcome(name, theme)) print("\n>>> ROADMAP <<<\n") print(generate_roadmap(name)) print("\n>>> MINT ANNOUNCEMENT <<<\n") print(generate_mint_announcement(name, supply, price, theme)) ``` ### Technical Analysis Interactive input and command-line arguments are treated as trusted display text. Values such as the collection name, tagline, theme, and Twitter handle are interpolated into generated strings and written directly to the terminal. No validation removes ASCII control characters, ANSI escape sequences, or other non-printable characters. If an attacker controls an input value, terminal emulators may interpret embedded sequences rather than displaying them literally. Depending on terminal capabilities and configuration, this could clear or reposition output, change colors, alter the terminal title, create misleading hyperlinks, or visually conceal subsequent messages. The script itself does not execute commands from th ...[truncated 1055 chars]- Remediation
View remediation
str: return CONTROL_CHARACTERS.sub("", value) ``` Apply the function before values are passed into generation functions or printed. If multiline content is not required, reject newline and carriage-return characters rather than silently removing them. ]]>