T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:9
- Finding
- Shell Command Injection Through Unquoted User-Controlled Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 9–19 **Vulnerability Type**: Command injection caused by unsafe argument interpolation **Risk Level**: High ### Vulnerable Code ```markdown Run the book2kindle CLI to search Z-Library and send EPUBs to Kindle. Execute: `.venv/bin/book2kindle $ARGUMENTS` ## Behavior - If `$ARGUMENTS` is empty, run `.venv/bin/book2kindle --help` and present the available commands. - For `search <title>`: run `.venv/bin/book2kindle search "<title>"` and display the results as a numbered list. - For `send <title> --pick N`: run `.venv/bin/book2kindle send "<title>" --pick N` directly. - For `send <title>` without `--pick`: first run `.venv/bin/book2kindle search "<title>"` to show results, then ask the user which one to send. Once they choose, run `.venv/bin/book2kindle send "<title>" --pick N`. - Pass through any other flags the user provides (e.g. `--pick`, `--limit`). ``` ### Technical Analysis The Skill directs the agent to interpolate the complete user-controlled `$ARGUMENTS` value into a Bash command without requiring structured parsing, shell escaping, or an allowlist: ```bash .venv/bin/book2kindle $ARGUMENTS ``` If the agent constructs and submits this as a shell command, Bash can interpret shell metacharacters embedded in the arguments, including command separators, pipelines, redirections, and command substitutions. Consequently, input intended to represent a book title or CLI option may be interpreted as additional shell syntax. The permission pattern `Bash(.venv/bin/book2kindle *)` does not, by itself, establish that the remainder of the command is safely passed as an argument array. A compound command can begin with the permitted executable while appending attacker-controlled shell operations. The instruction to pass through any other user-provided flags further weakens validation because it does not define which options or values are acceptable. Although some behavior-specific examples p ...[truncated 1834 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the generic instruction to execute `.venv/bin/book2kindle $ARGUMENTS`. 2. Parse user input into a command name, title, and explicitly supported options rather than forwarding a raw command fragment. 3. Allow only documented subcommands such as `search` and `send`. 4. Allowlist supported options, such as `--pick` and `--limit`, and reject unknown flags. 5. Validate numeric option values as bounded integers before execution. 6. Invoke the CLI using an argument-vector API that does not use a shell, equivalent to: ```text [".venv/bin/book2kindle", "search", validated_title] ``` 7. If Bash cannot be avoided, apply robust shell escaping to each individual argument and reject shell metacharacters, substitutions, redirections, and control operators. 8. Narrow the allowed-tool rules to specific command forms where the platform supports such restrictions. 9. Treat titles beginning with `-` as positional values, using an end-of-options marker such as `--` if supported by the CLI. 10. Add tests covering separators, command substitutions, quotes, newlines, redirections, and option-injection payloads. 11. Audit the absent `.venv/bin/book2kindle` implementation separately for credential handling, download validation, network security, and subprocess use before deployment. ]]>