T09 · Insecure Skill Coding Practices
Error
- Location
skill.md:19- Finding
Player-Controlled Text Is Unsafely Interpolated into a Shell-Style Command
- Content
View full analysis
` | ## Translate Player Input → Python Command Execute corresponding commands based on the player's natural language: - "I choose the first one/1" → `python game.py choose 1` - "Status" → `python game.py status` - "Items/Inventory" → `python game.py inventory` - "Input xxx" → `python game.py input xxx` ``` ### Technical Analysis The Skill instructs the AI agent to insert player-controlled natural-language text directly into a command. It does not require structured argument-array execution, escaping, quoting, or validation. The Python implementation itself does not invoke a shell: `game.py` reads the value from `sys.argv[2]`. However, the vulnerable command is constructed by the agent before Python receives it. If the agent's command tool passes the generated string through a shell, shell metacharacters in the player's text can terminate or modify the intended command. For example, input containing a semicolon, command substitution, pipeline, logical operator, or output redirection may be interpreted by the shell rather than passed as a literal argument to `game.py`. ### Attack Path 1. A player invokes the text-input feature using content containing shell syntax, such as `Input x; id`. 2. The Skill translates this directly into a command resembling: ```bash python game.py input x; id ``` 3. In a shell-backed execution environment, the shell treats the semicolon as a command separator. 4. `python game.py input x` runs first, followed by the attacker-supplied command. 5. The injected command runs with the same operating-system privileges, environment access, and filesystem access as the AI agent's command-execution process. ### Impact Assessment Successful exploitation can provide arbitrary ...[truncated 660 chars]- Remediation
View remediation