T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:52- Finding
Shell Command Injection Through Unvalidated Invocation Arguments
- Content
View full analysis
--output ``` ```bash feishu-cli wiki export --output ``` Related retry logic: ```bash sleep 5 && feishu-cli doc export ``` ### Technical Analysis The skill authorizes the `Bash` tool and instructs the agent to interpolate document IDs, node tokens, URLs, and output paths directly into shell command strings. It does not require strict input validation, safe shell quoting, argument-array execution, or rejection of shell metacharacters. If the agent replaces these placeholders through direct string construction, characters such as command separators, command substitutions, redirections, or newlines may be interpreted by the shell rather than passed to `feishu-cli` as literal argument content. Document identifiers and node tokens have predictable formats and can be validated using an allowlist. Output paths also require canonicalization and quoting. The absence of these controls makes command injection possible in implementations that follow the documented command templates literally. ### Attack Path 1. An attacker supplies a crafted document identifier, node token, URL, or output path containing shell syntax. 2. The agent substitutes that value into one of the documented Bash command templates. 3. The Bash interpreter parses the injected metacharacters as shell syntax. 4. The attacker's additional command executes with the same operating-system identity and tool permissions as the agent. 5. The injected process can access any local resources available to that identity, including configuration files and Feishu credentials. ### Impact Assessment Successful exploitation could provide arbitrary command execution under the agent's o ...[truncated 618 chars]- Remediation
View remediation