T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:98- Finding
Shell Command Injection Through Verbatim User Input
- Content
View full analysis
' [session_id] ``` ```bash python3 {baseDir}/scripts/migrateq_sse_api.py '' [session_id] ``` The forwarding rules in the same section require `question` to contain the user's original input without modification or translation. No shell-safe encoding procedure is specified. ### Technical Analysis The Skill permits Bash execution and instructs the agent to insert untrusted user input into a shell command between literal single quotes. Single quotes prevent ordinary expansion only while the input itself contains no single quote. An attacker can supply a quote that closes the argument, followed by shell operators and another command. The Python client does not independently launch a shell and is not directly vulnerable when invoked through a safe argument-array API. The vulnerability arises from the invocation procedure defined in `SKILL.md`, where an agent following the documented command template can pass the constructed string to Bash. This violates the separation between data and executable shell syntax. The additional requirement to preserve user input verbatim makes ad hoc filtering or rewriting incompatible with the current instructions. ### Attack Path 1. An attacker submits a migration question containing a single quote, shell separators, and a command, for example: ```text '; id > /tmp/migraq-command-injection; # ``` 2. The agent preserves the input verbatim as required by the forwarding rules. 3. The agent substitutes it into the documented Bash template: ```bash python3 .../migrateq_sse_api.py --no-auth ''; id > /tmp/migraq-command-injection; #' ``` 4. Bash treats the quote as the end of the `question` argument. 5. The injected command execu ...[truncated 801 chars]- Remediation
View remediation