T09 · Insecure Skill Coding Practices
- Location
SKILL.md:124- Finding
Shell Command Injection Through Direct Interpolation of User-Controlled Values
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 75–77, 124–133, 299–302, and 322–331
Vulnerability Type: Shell command injection caused by unsafe interpolation intocurlcommands
Risk Level: HighVulnerable Code
The Skill explicitly instructs the agent to inline values directly into commands:
text Always inline the real value into commands. Do not rely on shell variables.The onboarding request directly interpolates user-provided profile and contact data:
bash curl -s -X POST https://bot.guanma.top/sora-api/user/onboard \ -H "Content-Type: application/json" \ -d '{ "user_id": "{USER_ID}", "main_platform": "{用户回答1}", "category": "{用户回答2}", "contact": "{用户回答3}" }'The image upload request directly interpolates a user-controlled public URL:
bash curl -s -X POST "https://bot.guanma.top/sora-api/upload-image?user_id={USER_ID}" \ -H "Content-Type: application/json" \ -d '{"image_url": "{用户图片的公网URL}"}'The generation request directly interpolates structured product text, the platform-linked identifier, platform selection, voice selection, and image URL:
bash curl -s -X POST https://bot.guanma.top/sora-api/generate \ -H "Content-Type: application/json" \ -d '{ "user_id": "{USER_ID}", "platform": "{platform_key}", "product": "{结构化产品描述}", "voice": "{voice_key}", "image_url": "{产品图URL或空字符串}" }' \ --max-time 400Technical Analysis
The documented implementation builds shell commands by textual substitution rather than passing values through a structured HTTP API or a safe JSON serializer. Several substituted fields are wholly or partially controlled by the user, including contact information, product descriptions, uploaded image URLs, and values derived from the session identifier.
The JSON request bodies are enclosed in single-quoted shell arguments. A supplied value c ...[truncated 3141 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace shell command templates with a structured HTTP client. Use an API that accepts the URL, headers, query parameters, and JSON body as separate typed values. Serialize request bodies with a standard JSON encoder rather than manually assembling JSON.
-
Remove the instruction to inline values directly into commands. Replace it with an explicit prohibition against concatenating or substituting untrusted values into shell source.
-
If command-line
curlis unavoidable, generate JSON safely. For example, construct the body withjqusing separate--argparameters:bash jq -n \ --arg user_id "$USER_ID" \ --arg platform "$PLATFORM" \ --arg product "$PRODUCT" \ --arg voice "$VOICE" \ --arg image_url "$IMAGE_URL" \ '{user_id:$user_id, platform:$platform, product:$product, voice:$voice, image_url:$image_url}' \ | curl -sS -X POST "https://bot.guanma.top/sora-api/generate" \ -H "Content-Type: application/json" \ --data-binary @- \ --max-time 400Values must be passed as arguments by the runtime rather than generated as part of a shell command string. The runtime must not use
eval,sh -c, or an equivalent reparsing mechanism. -
Encode URL components independently. Platform-linked user IDs and other path or query values should be passed through a proper URL encoder. Do not interpolate raw values into paths or query strings.
-
Validate inputs using allowlists. Restrict platform and voice values to the documented enumerations. Validate public image URLs as HTTPS URLs and reject control characters. Apply reasonable length limits to product descriptions, contact fields, identifiers, and URLs.
-
Treat validation as defense in depth. Input validation must not replace context-appropriate shell escaping, JSON serialization, and URL encoding.
-
**Run the integration with minimal privile ...[truncated 526 chars]
-