T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:18
- Finding
- Command Injection Through Unquoted User-Controlled Video URLs## Vulnerability Details **File Location**: `SKILL.md`, lines 18–25 **Vulnerability Type**: OS command injection caused by unsafe shell command construction **Risk Level**: High ### Vulnerable Code ```bash you-get -o ./video https://www.bilibili.com/video/BVxxx # or yt-dlp https://www.bilibili.com/video/BVxxx -o ./video ``` ```bash you-get -o ./video https://www.douyin.com/video/xxx ``` ### Technical Analysis The Skill accepts video URLs from users and instructs the Agent to substitute those values into shell commands. The affected examples pass the URL as an unquoted shell argument. If the Agent interpolates an attacker-controlled value verbatim, shell metacharacters such as `;`, `&&`, `|`, redirection operators, or command substitutions may be interpreted as shell syntax rather than as part of the URL. For example, a malicious value shaped like a supported URL followed by `; attacker-command` could cause the downloader to run first and then execute the injected command. Merely adding quotes is not a complete defense in every construction scenario; the safer approach is to avoid invoking a shell and pass the validated URL as a discrete argument through a process-execution API. The issue applies to the unquoted Bilibili and Douyin examples. The generic-platform example elsewhere in the file quotes its URL but does not eliminate the need for strict validation and shell-free process invocation. ### Attack Path 1. An attacker provides a purported Bilibili or Douyin video URL containing shell-control syntax. 2. The Skill selects the corresponding documented download command. 3. The Agent replaces the example URL with the attacker-controlled value without validation or argument-safe escaping. 4. The command is submitted to a shell. 5. The shell parses the injected metacharacters and executes additional attacker-selected commands. 6. Those commands run with the operating-system privileges and accessible environmen ...[truncated 693 chars]
- Remediation
- ## Remediation Suggestions 1. Do not construct shell command strings by concatenating or interpolating user-provided URLs. 2. Invoke `you-get` and `yt-dlp` through a process API that accepts an executable and argument array, with shell execution disabled. Treat the entire URL as one argument. 3. Parse the URL before execution and allow only expected schemes such as `https`. 4. Apply a hostname allowlist for platform-specific branches, such as the exact approved Bilibili and Douyin domains, while accounting for explicitly supported subdomains. 5. Reject malformed URLs, embedded credentials, control characters, line breaks, and unexpected schemes. 6. Use a fixed, application-controlled output directory and filename rather than accepting path components from users. 7. Run download and media-processing tools in a sandbox with minimal filesystem permissions, restricted network access, execution timeouts, and resource limits. 8. If a shell is unavoidable, use a platform-appropriate escaping routine for every untrusted argument. Quoting alone should not replace URL validation or shell-free invocation. 9. Update every command example consistently so Agents are not encouraged to copy an unsafe invocation pattern.