T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:28
- Finding
- Shell Command Injection Through User-Controlled ARC Metadata<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 28-32, 46-50, 67-70, 100-103, and 107-117 **Vulnerability Type**: OS command injection caused by unsafe construction of shell commands **Risk Level**: High The skill instructs the agent to insert user-provided paths, identifiers, titles, descriptions, contact details, and Git identity values directly into shell commands. ### Vulnerable Code `SKILL.md:28-32`: ```markdown Then run `scripts/create_arc.sh <path> <identifier>` and set investigation metadata via: ```bash arc investigation update -i "<id>" --title "<title>" --description "<desc>" ``` ``` `SKILL.md:46-50`: ```markdown Create with: ```bash arc study init --studyidentifier "<id>" arc study update --studyidentifier "<id>" --title "<title>" --description "<desc>" ``` ``` `SKILL.md:67-70`: ```markdown Create with: ```bash arc assay init -a "<id>" --measurementtype "<type>" --technologytype "<tech>" ``` ``` `SKILL.md:100-103`: ```markdown Add via: ```bash arc investigation person register --lastname "<last>" --firstname "<first>" --email "<email>" --affiliation "<aff>" ``` ``` `SKILL.md:107-117`: ```markdown 1. Configure git user: ```bash git config user.name "<name>" git config user.email "<email>" ``` 2. Commit: ```bash git add -A git commit -m "Initial ARC: <investigation title>" ``` ``` ### Technical Analysis The placeholders in these command templates represent values collected conversationally from the user. If the agent replaces the placeholders with raw input and submits the resulting text to a shell, shell syntax contained in those values is interpreted during command parsing. Double quotes do not make this construction safe. They prevent ordinary word splitting and pathname expansion, but still permit command substitution such as `$(command)` and backtick substitution. Quote-breaking input can also terminate the quoted argument and append additional shell operators. The ARC path invocation is particularly expose ...[truncated 2522 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Avoid shell command strings** - Invoke `arc`, `git`, and `scripts/create_arc.sh` through an execution API that accepts a program and an argument array. - Disable shell interpretation when the tool or runtime provides such an option. - Pass every collected value as a distinct argument. 2. **Add explicit instructions to the skill** - State that user-provided values must never be concatenated or interpolated into shell source code. - Replace the current shell templates with structured argument-array examples appropriate to the agent's execution tools. 3. **Apply strict validation** - Restrict investigation, study, assay, workflow, and run identifiers to an allowlist such as: ```regex ^[a-z0-9]+(?:-[a-z0-9]+)*$ ``` - Reject NUL bytes, newlines, and control characters in all fields. - Treat titles, descriptions, names, affiliations, and email addresses as opaque argument data rather than shell syntax. 4. **Harden path handling** - Resolve the destination to a canonical absolute path. - Enforce an approved base directory if ARC creation should be confined to a workspace. - Reject paths outside that directory after canonicalization. - Pass the validated path as one quoted argument or, preferably, as an argument-array element. 5. **Use robust escaping only as a fallback** - If a shell is unavoidable, use a trusted language or library function that performs POSIX-shell escaping for each individual argument. - Do not rely on manually adding double quotes. - Never evaluate the resulting text with `eval`, `bash -c`, or equivalent mechanisms. 6. **Add adversarial tests** - Test all collected fields with values containing `$(...)`, backticks, semicolons, quotes, newlines, redirections, wildcard characters, and leading option characters. - Verify that these values are either rejected or passed literally without executing additional commands. ]]>