T09 · Insecure Skill Coding Practices
Error
- Location
- references/task-permission-check.md:27
- Finding
- Potential Command Injection Through Unvalidated CLI Parameters<![CDATA[ ## Vulnerability Details **File Location**: `references/task-permission-check.md:27-29` **Vulnerability Type**: Command injection through unsafe command construction **Risk Level**: High ### Vulnerable Code ```bash hcloud CDN ShowDomainDetailByName --cli-region=<region> --domain_name=<domain> ``` ### Technical Analysis The documented workflow interpolates the user-supplied `region` and `domain` values into a shell-form command. The document does not require these values to be validated before this command is executed, nor does it require the command to be invoked through an argument-array API that avoids shell interpretation. Although `scripts/dns_resolve.py` subsequently validates the domain against an RFC 1035-oriented regular expression, that validation occurs inside the DNS probe and does not protect the earlier `hcloud` command. The region parameter is also not explicitly enforced against the documented allowlist of `cn-north-1` and `ap-southeast-1`. If an Agent implementation constructs this command as a string and executes it through a shell, metacharacters in either value could be interpreted as shell syntax rather than as part of a CLI argument. ### Attack Path 1. An attacker supplies a crafted domain or region containing shell metacharacters and an additional command. 2. The Agent substitutes the value directly into the documented command template. 3. The resulting command string is passed to a shell. 4. The shell interprets the injected metacharacters and executes the attacker-controlled command. 5. The injected process inherits the Agent process's operating-system permissions and environment. Exploitation depends on the command being executed through a shell without independent validation or safe argument handling. ### Impact Assessment Successful exploitation could permit arbitrary local command execution with the privileges of the Agent process. Depending on its runtime permissions, this could expose local files, CLI configurat ...[truncated 414 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate the domain before any CLI command using the same strict policy applied by `scripts/dns_resolve.py`. 2. Restrict the region to an explicit allowlist: - `cn-north-1` - `ap-southeast-1` 3. Execute `hcloud` through an argument-array API without invoking a shell. For example, use a structure equivalent to: ```python subprocess.run( [ "hcloud", "CDN", "ShowDomainDetailByName", f"--cli-region={region}", f"--domain_name={domain}", ], shell=False, check=True, ) ``` 4. Explicitly prohibit string concatenation, `shell=True`, `os.system`, and similar shell-mediated execution in the Skill instructions. 5. Reject values containing whitespace, control characters, shell metacharacters, or unexpected Unicode characters. 6. Perform all validation before credential checks or authenticated cloud commands. 7. Apply the same safe execution requirements consistently to every documented `hcloud` invocation. ]]>