T09 · Insecure Skill Coding Practices
- Location
SKILL.md:61- Finding
Command Injection Through Unsafely Interpolated Recall Topics
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 61-63
Vulnerability Type: OS command injection
Risk Level: HighVulnerable Code
bash gbrain search "<user's exact topic>" --limit 5 gbrain search "<selected anchor or close synonym>" --limit 5 cm context "<user's exact topic>" --json --limit 5 --history 5Technical Analysis
The skill instructs the agent to insert user-controlled topics and selected anchor text directly into double-quoted shell command strings. Double quotes do not prevent shell evaluation of command substitutions such as
$(...)or backticks. Inputs containing quote-breaking syntax may also alter the command structure.Therefore, if the agent implements these instructions through a shell, text intended only as a search query can be interpreted as executable shell syntax. No validation, shell escaping, argument-array invocation, or explicit prohibition against shell evaluation is specified.
Attack Path
- An attacker requests an aphorism about a topic containing shell metacharacters or command substitution syntax.
- The skill directs the agent to use the attacker's exact topic in the documented recall commands.
- The agent substitutes the topic into one or both command templates.
- The agent executes the resulting command through a shell.
- The shell evaluates the injected syntax before or while invoking
gbrainorcm. - The injected command executes with the operating-system privileges and environment available to the agent.
Exploitation depends on the runtime following these command templates through a shell rather than using a shell-disabled argument API.
Impact Assessment
Successful exploitation can provide arbitrary command execution under the agent process's user account. The attacker could potentially read accessible second-brain notes and other local files, modify or delete user data, invoke installed programs, access ...[truncated 329 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not construct command-line strings by interpolating user-controlled text.
- Invoke
gbrainandcmwith a shell-disabled process API and an explicit argument array, for example conceptually:text ["gbrain", "search", userTopic, "--limit", "5"] ["cm", "context", userTopic, "--json", "--limit", "5", "--history", "5"] - Explicitly instruct the agent never to use
shell=true,sh -c,bash -c, or equivalent wrappers for recall queries. - Treat anchor names and synonyms derived from user-controlled notes as untrusted input as well.
- If only a shell interface is available, apply platform-specific escaping with a well-tested library and reject control characters, command substitutions, redirection operators, separators, and unexpected newlines. Validation alone should not replace shell-disabled execution.
- Add adversarial tests covering inputs containing
$(), backticks, quotes, semicolons, pipes, redirections, newlines, and shell-specific expansion syntax. - Run recall tools with least privilege, restricted filesystem access, a minimal environment, and network access disabled unless explicitly required.