T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:34- Finding
Unquoted User-Controlled File Paths in Documented Shell Workflows
- Content
View full analysis
``` ```bash python3 scripts/key_info_extractor.py --action summary --text-file ``` ```bash python3 scripts/risk_analyzer.py --action full-report --text-file ``` ```bash python3 scripts/contract_parser.py --action extract-text --file ``` ```bash python3 scripts/key_info_extractor.py --action extract --text-file ``` ```bash python3 scripts/contract_store.py --action archive --data '' ``` ```bash python3 scripts/contract_comparator.py --action diff-report --file1 --file2 ``` ### Technical Analysis The Skill instructs an agent to interpolate user-supplied file paths and JSON data directly into shell command strings. The placeholders are not quoted, and the instructions do not require an argument-array process API or prohibit shell interpretation. If an agent implements these workflows by constructing a command string and passing it to a shell, shell metacharacters in a supplied path can terminate the intended argument and introduce an additional command. Quoting the JSON argument with single quotes is also insufficient when attacker-controlled JSON can itself contain a single quote. The Python scripts use `argparse` and do not independently invoke a shell. The vulnerability arises at the Skill orchestration layer when the documented commands are assembled and executed through a shell. ### Attack Path 1. An attacker provides or references a contract whose filename contains shell metacharacters, such as: ```text contract.txt; attacker-command ``` 2. The user asks the agent to parse, analyze, or compare that contr ...[truncated 1190 chars]- Remediation
View remediation