T09 · Insecure Skill Coding Practices
- Location
SKILL.md:23- Finding
Shell Command Injection Through User-Controlled Schedule Fields
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 23-28 and 75
Vulnerability Type: Shell command injection caused by unsafe interpolation of user input
Risk Level: HighVulnerable Code Snippet
The following is an English rendering of the documented command pattern:
bash python {baseDir}/scripts/schedule_crud.py add --task "task name" --deadline "YYYY-MM-DD HH:mm" --priority P0 [--note "note"]The operational workflow repeats the same vulnerable pattern:
bash python {baseDir}/scripts/schedule_crud.py add --task "..." --priority P0 [--deadline "..."] [--note "..."]The skill explicitly requires schedule operations to be executed through Bash. Task names, deadlines, and notes originate from user input and are inserted into the command template.
Technical Analysis
Placing untrusted data between double quotes does not make it safe for shell execution. Bash continues to process command substitutions such as
$(command)and backticks inside double-quoted strings. An attacker can also include a quotation mark followed by shell control operators to terminate the intended argument and introduce another command.For example, a task value conceptually equivalent to:
text $(id > /tmp/schedule-audit-result)would be evaluated by Bash before Python receives the
--taskargument. A payload containing a closing quotation mark, a semicolon, and a comment marker could similarly escape the argument context.The Python implementation does not directly invoke a shell. The vulnerability is introduced by the skill instructions, which mandate Bash execution while providing no structured argument invocation, escaping routine, or restriction against interpolating raw user content.
Attack Path
- An attacker asks the agent to create or modify a schedule entry.
- The attacker places shell syntax or command substitution in the task name, note, or another interpolated field.
...[truncated 1042 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not build a shell command by concatenating or interpolating user-controlled strings.
- Invoke Python through a structured process API using an argument array and with shell processing disabled. The arguments should be passed as separate values, conceptually:
python subprocess.run( [ sys.executable, script_path, "add", "--task", task, "--deadline", deadline, "--priority", priority, "--note", note, ], shell=False, check=True, ) - If the agent platform supports typed tool calls, expose schedule operations as typed fields rather than instructing the model to compose Bash.
- If Bash cannot be avoided, apply a trusted shell-quoting implementation to every dynamic argument. Do not rely on manually surrounding values with quotation marks.
- Add input length and control-character limits as defense in depth, while recognizing that validation is not a substitute for eliminating shell interpretation.
- Add regression tests using quotation marks, semicolons, newlines, backticks, dollar-sign command substitutions, and leading option-like values.