T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:125
- Finding
- Command Injection Through Unsafe Coding-Agent Delegation Templates<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:125-127` - `references/escalation-guide.md:20-22` **Vulnerability Type**: Shell command injection through unsafe interpolation **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:125-127`: ```text For large tasks (multi-file refactors, entire features, long builds), spawn a background agent: exec pty:true workdir:"<project>" background:true command:"claude '<detailed task>'" ``` From `references/escalation-guide.md:20-22`: ```text If you have a coding agent CLI installed (e.g. Claude Code, Codex, Aider), spawn it for heavy tasks: exec pty:true background:true command:"<agent> '<task description>'" ``` ### Technical Analysis The skill instructs an agent to construct a shell command by interpolating a detailed task description into a single-quoted command-line argument. Single quotes do not provide adequate protection if the interpolated value itself contains a single quote. Such a value can terminate the intended quoted argument and introduce shell operators or additional commands. For example, if untrusted text is incorporated into the task description, a payload conceptually shaped like the following can escape the quoting context: ```text ' ; <attacker-controlled command> ; # ``` The instructions do not require the agent to: - Use an argument-array execution API that bypasses shell parsing. - Escape or validate task descriptions. - Send task content through standard input. - Distinguish trusted user instructions from untrusted repository content. - Obtain explicit approval before transmitting repository context to another coding-agent CLI. The vulnerability is in the documented execution pattern. Exploitation depends on the host agent following that pattern and passing attacker-controlled text into a shell-interpreted command. ### Attack Path 1. An attacker places a malicious quote and shell syntax in task text, an error message, a repository file, an issue description, or ...[truncated 1653 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Do not concatenate task text into shell commands.** Invoke coding-agent CLIs through an execution interface that accepts an executable and an argument array without invoking a shell. Conceptual safe structure: ```text executable: "claude" arguments: ["<detailed task>"] shell: false ``` 2. **Prefer standard input for long or untrusted prompts.** Pass the task description through stdin rather than embedding it in a command string. 3. **Use a securely created temporary file if stdin is unavailable.** Create it with restrictive permissions, pass only its path as an argument, and remove it safely after use. 4. **Do not rely only on quote escaping.** Shell escaping is platform-dependent and error-prone. If shell execution is unavoidable, use a well-tested platform-specific escaping library and reject control characters or unsupported input. 5. **Treat repository content as untrusted.** Do not copy error messages, file contents, issue descriptions, or generated text directly into executable command templates. 6. **Require explicit user approval before external delegation.** State which external coding-agent provider will be used and what task or repository information may be shared. 7. **Apply least privilege.** Run delegated agents in a sandbox with restricted filesystem, credential, and network access. Avoid exposing unrelated environment variables or home-directory secrets. 8. **Update both documented templates.** Correct `SKILL.md:125-127` and `references/escalation-guide.md:20-22` so future agents are not directed to reproduce the unsafe pattern. ]]>