T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:16- Finding
Shell Command Injection Through Unsafe Note Interpolation
- Content
View full analysis
--note "" ``` ### Technical Analysis The Skill instructs the agent to insert user-controlled note text directly into a shell command enclosed in double quotes. Double quotes do not prevent shell evaluation of command substitutions such as `$(...)` or backticks. Embedded quotation marks may also terminate the intended argument and expose additional shell syntax. If the agent follows this instruction through a shell-based execution tool, malicious note content can be interpreted by the shell before `add_note.py` or `argparse` receives it. The Python script's argument validation therefore does not mitigate this issue. ### Attack Path 1. An attacker submits a capability observation containing shell syntax, such as `$(touch /tmp/injected)`. 2. The agent extracts that observation as the note text. 3. Following `SKILL.md`, the agent constructs a command resembling: ```sh python3 skills/computer-use-notes/scripts/add_note.py --category can-do --note "$(touch /tmp/injected)" ``` 4. The shell evaluates the command substitution before starting the Python process. 5. The injected command executes with the same operating-system privileges as the agent or skill runner. 6. More consequential payloads could read or modify files accessible to that account or invoke other locally available programs. ### Impact Assessment Successful exploitation permits arbitrary command execution with the privileges of the process executing the Skill. The accessible scope includes files, environment variables, credentials, tools, and network resources available to that account. This issue does not independently provide privilege escalation, but its impact can be substantial when the agent runs with broad workspace or system ac ...[truncated 11 chars]- Remediation
View remediation