T09 · Insecure Skill Coding Practices
Error
- Location
scripts/query_all_v2.py:35- Finding
Shell Command Injection Through User-Controlled and Browser-Derived Values
- Content
View full analysis
' 'a.innerText.includes(\'' + company_name + '\') && a.href.includes(\'firm\'))?.href || \'\'"' ) if detail_url and "qcc.com/firm/" in detail_url: run_agent_browser(f'open "{detail_url}"') ``` The PDF conversion path independently invokes a shell with the company name: ```python result = subprocess.run( f'pandoc "{md_file}" -o "{html_file}" --standalone --metadata title="{company_name}"', shell=True, capture_output=True, text=True, timeout=30 ) ``` ### Technical Analysis The application constructs command strings by concatenating `company_name`, URLs, file paths, and browser-returned data, and then executes those strings with `shell=True`. Double quotes around a value do not neutralize shell command substitution, embedded quote characters, or other shell syntax. The company name originates directly from `sys.argv[1]`. It reaches both `run_agent_browser()` and the Pandoc command without shell-safe arg ...[truncated 1786 chars]- Remediation
View remediation