T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:125- Finding
Command Injection Through Unsafe Coding-Agent Delegation Templates
- Content
View full analysis
" background:true command:"claude ''" ``` From `references/escalation-guide.md:20-22`: ```text If you have a coding agent CLI installed (e.g. Claude Code, Codex, Aider), spawn it for heavy tasks: exec pty:true background:true command:" ''" ``` ### Technical Analysis The skill instructs an agent to construct a shell command by interpolating a detailed task description into a single-quoted command-line argument. Single quotes do not provide adequate protection if the interpolated value itself contains a single quote. Such a value can terminate the intended quoted argument and introduce shell operators or additional commands. For example, if untrusted text is incorporated into the task description, a payload conceptually shaped like the following can escape the quoting context: ```text ' ; ; # ``` The instructions do not require the agent to: - Use an argument-array execution API that bypasses shell parsing. - Escape or validate task descriptions. - Send task content through standard input. - Distinguish trusted user instructions from untrusted repository content. - Obtain explicit approval before transmitting repository context to another coding-agent CLI. The vulnerability is in the documented execution pattern. Exploitation depends on the host agent following that pattern and passing attacker-controlled text into a shell-interpreted command. ### Attack Path 1. An attacker places a malicious quote and shell syntax in task text, an error message, a repository file, an issue description, or ...[truncated 1653 chars]- Remediation
View remediation
"] shell: false ``` 2. **Prefer standard input for long or untrusted prompts.** Pass the task description through stdin rather than embedding it in a command string. 3. **Use a securely created temporary file if stdin is unavailable.** Create it with restrictive permissions, pass only its path as an argument, and remove it safely after use. 4. **Do not rely only on quote escaping.** Shell escaping is platform-dependent and error-prone. If shell execution is unavoidable, use a well-tested platform-specific escaping library and reject control characters or unsupported input. 5. **Treat repository content as untrusted.** Do not copy error messages, file contents, issue descriptions, or generated text directly into executable command templates. 6. **Require explicit user approval before external delegation.** State which external coding-agent provider will be used and what task or repository information may be shared. 7. **Apply least privilege.** Run delegated agents in a sandbox with restricted filesystem, credential, and network access. Avoid exposing unrelated environment variables or home-directory secrets. 8. **Update both documented templates.** Correct `SKILL.md:125-127` and `references/escalation-guide.md:20-22` so future agents are not directed to reproduce the unsafe pattern. ]]>