T09 · Insecure Skill Coding Practices
- Location
SKILL.md:86- Finding
Potential Shell Command Injection Through Unsafe User-Question Interpolation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 86-90
Vulnerability Type: Shell command injection
Risk Level: HighVulnerable Code
markdown - If the user gives a specific question, run dry routing only: ```bash python3 /Users/jianghaidong/.agents/skills/hbrain-cognitive-loop/scripts/hbrain_loop.py route --query "<user question>"text ### Technical Analysis The skill instructs the agent to place a user-supplied question inside a double-quoted shell argument. It does not require an argument-array execution API, escaping, validation, or another mechanism that preserves the question strictly as data. If an implementation performs literal placeholder substitution and then invokes the resulting text through a shell, an attacker can include a double quote to terminate the argument and append shell operators or command substitutions. Double quotes do not prevent command substitution, and an injected closing quote can expose additional shell syntax. The vulnerability depends on the agent or runtime translating this documentation example into a shell command through unsafe textual interpolation. Passing the question directly as an argument without a shell would prevent this exploitation path. ### Attack Path 1. An attacker asks the agent to evaluate or route a specially crafted “specific question.” 2. The question contains syntax that escapes the intended quoted argument, such as a closing double quote followed by a shell operator and an attacker-selected command. 3. The agent replaces `<user question>` verbatim in the documented command. 4. The agent executes the constructed command through a shell. 5. The shell interprets the injected syntax and runs the attacker-selected command with the agent process's permissions. For example, unsafe substitution of a payload shaped like the following would alter shell parsing: ```text "; ATTACKER_SELECTED_COMMAND; #Impact Assessment
Successful exploitation could execute arbitrar ...[truncated 628 chars]
- Remediation
View remediation
Remediation Suggestions
-
Execute the Python program through an argument-array API rather than constructing a shell command. For example, equivalent implementations should pass separate arguments:
python subprocess.run( [ "python3", "/Users/jianghaidong/.agents/skills/hbrain-cognitive-loop/scripts/hbrain_loop.py", "route", "--query", user_question, ], shell=False, check=True, ) -
Amend the skill instructions to explicitly prohibit verbatim interpolation into shell command strings and prohibit
shell=True. -
If only a shell interface is available, apply robust platform-appropriate quoting such as Python's
shlex.quote; argument-array execution should still be preferred. -
Treat the full question as untrusted data. Do not interpret embedded command substitutions, redirections, newlines, or shell operators.
-
Add tests containing quotes, command substitutions, semicolons, newlines, pipes, and redirection characters to verify that the complete input reaches
--queryas one literal argument. -
Consider replacing the executable example with a structured tool-call example so an agent is less likely to reproduce it using textual shell interpolation.
-