T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:9- Finding
Shell Command Injection Through Unquoted User-Controlled Arguments
- Content
View full analysis
`: run `.venv/bin/book2kindle search ""` and display the results as a numbered list. - For `send <title> --pick N`: run `.venv/bin/book2kindle send "<title>" --pick N` directly. - For `send <title>` without `--pick`: first run `.venv/bin/book2kindle search "<title>"` to show results, then ask the user which one to send. Once they choose, run `.venv/bin/book2kindle send "<title>" --pick N`. - Pass through any other flags the user provides (e.g. `--pick`, `--limit`). ``` ### Technical Analysis The Skill directs the agent to interpolate the complete user-controlled `$ARGUMENTS` value into a Bash command without requiring structured parsing, shell escaping, or an allowlist: ```bash .venv/bin/book2kindle $ARGUMENTS ``` If the agent constructs and submits this as a shell command, Bash can interpret shell metacharacters embedded in the arguments, including command separators, pipelines, redirections, and command substitutions. Consequently, input intended to represent a book title or CLI option may be interpreted as additional shell syntax. The permission pattern `Bash(.venv/bin/book2kindle *)` does not, by itself, establish that the remainder of the command is safely passed as an argument array. A compound command can begin with the permitted executable while appending attacker-controlled shell operations. The instruction to pass through any other user-provided flags further weakens validation because it does not define which options or values are acceptable. Although some behavior-specific examples p ...[truncated 1834 chars]- Remediation
View remediation