T09 · Insecure Skill Coding Practices
- Location
SKILL.md:235- Finding
Shell Command Injection Through Unsafe Filename Interpolation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 235
Vulnerability Type: Shell command injection and unsafe filename handling
Risk Level: HighVulnerable Code:
bash find . -name "*.jpg" | xargs -P 8 -I {} sh -c 'convert {} -resize 800x600 resized/{} && echo "Done: {}"'Technical Analysis
The example substitutes filenames directly into a command string evaluated by
sh -c. Because the substituted value is interpreted as shell syntax rather than passed exclusively as a command argument, a crafted filename containing quotes, command substitutions, separators, redirections, or other shell metacharacters can change the command's structure and execute unintended commands.The pipeline also uses newline-delimited
findoutput rather than NUL-delimited records. Consequently, valid filenames containing newlines can be split into separate inputs, while spaces and quoting characters can produce incorrect or dangerous command interpretation.Although this is documentation rather than an executable script, the Skill explicitly recommends the pattern for generated shell code. Copying or generating this example in a directory containing attacker-controlled filenames creates an exploitable command-execution path.
Attack Path
- An attacker gains the ability to create or extract a
.jpgfile in a directory processed by the generated command. - The attacker gives the file a name containing shell syntax that breaks out of the intended
convertargument context. findemits the crafted filename.xargs -I {}inserts the filename directly into the single-quoted command template.sh -cparses the resulting text as shell code.- The injected command executes with the privileges of the user or service running the script.
Impact Assessment
Successful exploitation permits arbitrary command execution under the script runner's account. The attacker could read or modify any files a ...[truncated 282 chars]
- An attacker gains the ability to create or extract a
- Remediation
View remediation
Remediation Suggestions
Do not interpolate filenames into shell source. Use NUL-delimited records and pass each filename as a positional parameter:
bash find . -name '*.jpg' -print0 | xargs -0 -P 8 -I {} sh -c ' input=$1 output="resized/$(basename "$input")" convert "$input" -resize 800x600 "$output" && printf "Done: %s\n" "$input" ' sh '{}'Prefer invoking a dedicated processing script directly so no additional shell parser is required:
bash find . -name '*.jpg' -print0 | xargs -0 -P 8 -n 1 ./process-image.shInside
process-image.sh, quote every expansion, derive output paths safely, reject unexpected path structures where appropriate, and use--before operands for tools that support it.