T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:131
- Finding
- Shell Command Injection Through an Unescaped User-Controlled Keyword## Vulnerability Details **File Location**: `SKILL.md`, line 131 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Complete Vulnerable Instruction ```text 1. Personal canonical source: python3 {vault}/07-scripts-and-tools/surface_candidates.py --kw "{keyword}" --top 15, prioritizing save rate. ``` The source instruction directly places the user-supplied keyword into a shell command. The path labels and placeholder above are rendered in English, but the command structure is unchanged. ### Technical Analysis The value represented by `{keyword}` originates from the user's topic request and is inserted into a command enclosed only by double quotes. Double quotes do not prevent shell evaluation of command substitutions such as `$()` or backticks. If the agent follows this instruction through a shell execution tool, a value such as: ```text $(id > /tmp/agent-command-proof) ``` can be evaluated by the shell before it is passed to the Python script. Other shell metacharacters may become exploitable if quoting is changed, omitted, or reconstructed by the agent. This is an instruction-level command-injection flaw rather than evidence that a malicious payload is currently bundled in the project. Exploitability depends on the agent using a shell to execute the documented command, which the Skill explicitly directs it to do. ### Attack Path 1. An attacker invokes the Skill with a crafted topic or keyword containing shell command substitution. 2. The Skill interpolates that value into the documented `python3` command. 3. The agent submits the reconstructed command to a shell-capable execution tool. 4. The shell evaluates the substitution before launching `surface_candidates.py`. 5. The injected command executes with the operating-system identity and permissions of the agent process. ### Impact Assessment Successful exploitation permits arbitrary command execution within the agent's existing pr ...[truncated 647 chars]
- Remediation
- ## Remediation Suggestions - Do not construct a shell command by interpolating user-controlled text. - Invoke the program through a structured process API with a fixed argument array, for example: ```python subprocess.run( [ "python3", validated_script_path, "--kw", user_keyword, "--top", "15", ], check=True, shell=False, ) ``` - If the agent platform supports structured command arguments, require that interface and explicitly prohibit shell execution. - Validate the keyword against an appropriate length and character policy before execution. - Resolve and validate the script path against an approved vault root. - Run the script in a sandbox with minimal filesystem and network permissions. - Add a regression test using payloads containing `$()`, backticks, quotes, newlines, semicolons, and redirection characters. - If safe structured execution cannot be guaranteed, remove automatic execution and require explicit user approval after displaying the exact command and arguments.