T09 · Insecure Skill Coding Practices
- Location
SKILL.md:157- Finding
Unsafe Shell-Based URL Ingestion Permits Command Injection, SSRF, and Path Traversal
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 157–160
Vulnerability Type: Unvalidated user-controlled shell arguments and destination path
Risk Level: Highmarkdown 1. **Capture raw material** - URL: fetch with `curl -sL <url> | head -c 100000 > raw/inbox/<slug>.md` (prepend URL as comment) - File: copy to `raw/inbox/`Technical Analysis
The skill instructs an agent to substitute a URL and slug into a shell command without requiring shell-safe argument handling, URL validation, or destination-path containment. If these values are interpolated literally, shell metacharacters in either value could change the command and permit arbitrary command execution.
The retrieval design also permits server-side request forgery and local-resource access. It does not restrict URLs to HTTP or HTTPS, reject loopback/private/link-local destinations, or protect against redirects to prohibited destinations. The
-Loption follows redirects, whilecurlsupports protocols and locations beyond ordinary public web pages. Consequently, an attacker may cause the agent to request internal services, cloud metadata endpoints, or local resources and persist the response in the knowledge-base vault.The slug is used as part of an output path without a strict format or canonical-path check. A slug containing path separators or
..components could write outsideraw/inbox/. The adjacent file-copy instruction similarly does not require source authorization, rejection of sensitive files, or destination containment.Attack Path
- An attacker asks the agent to ingest a crafted URL, file path, or source name.
- The agent substitutes attacker-influenced values into the documented
curlcommand or copy operation. - One or more unsafe behaviors occur:
- Shell metacharacters alter the intended command.
- A URL targets a local, private, link-local, or cloud metadata endpoint.
- A public URL redirects to a prohibited internal destinat ...[truncated 1106 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not construct a shell command by concatenating or interpolating user-controlled values. Invoke the HTTP client through an argument-array API.
- Permit only explicitly required URL schemes, preferably
httpsand optionallyhttp. - Resolve destination hostnames and reject loopback, private, link-local, multicast, reserved, and cloud-metadata addresses.
- Validate every redirect target under the same policy, or disable redirects unless explicitly required.
- If
curlmust be used, include--before the validated URL and apply strict protocol, redirect, timeout, and download-size limits. - Generate slugs internally and require a pattern such as
^[a-z0-9]+(?:-[a-z0-9]+)*$; never accept path separators or traversal components. - Canonicalize the output path and verify that it remains inside
raw/inbox/before writing. - Quote all filesystem paths and prevent overwriting existing files unless the user explicitly approves it.
- Restrict local-file ingestion to user-approved roots. Reject credential files, private keys, tokens, agent memory, configuration secrets, and other sensitive sources by default.
- Treat downloaded content strictly as untrusted data. Do not execute it or follow instructions embedded in retrieved documents.
- Run ingestion with minimal filesystem permissions and restricted outbound network access to reduce impact if validation fails.