T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/tts.sh:38- Finding
Unvalidated CLI Arguments Permit JSON Request Injection
- Content
View full analysis
- Remediation
View remediation
&2; exit 1; } [[ "$TEMP" =~ ^([0-9]+([.][0-9]+)?|[.][0-9]+)$ ]] || { echo "Invalid temperature" >&2; exit 1; } awk -v value="$RATE" 'BEGIN { exit !(value >= 0.5 && value <= 2.0) }' || { echo "Speaking rate must be between 0.5 and 2.0" >&2; exit 1; } awk -v value="$TEMP" 'BEGIN { exit !(value >= 0.1 && value <= 2.0) }' || { echo "Temperature must be between 0.1 and 2.0" >&2; exit 1; } PAYLOAD=$(jq -n \ --arg text "$TEXT" \ --arg voice "$VOICE" \ --arg model "$MODEL" \ --argjson rate "$RATE" \ --argjson temp "$TEMP" \ '{ text: $text, voice_id: $voice, audio_config: { audio_encoding: "MP3", speaking_rate: $rate }, temperature: $temp, model_id: $model }') ``` Also validate voice and model identifiers against documented formats or an allowlist when possible. Reject missing values for options such as `--voice` before attempting to read `$2`. ]]>