T09 · Insecure Skill Coding Practices
- Location
SKILL.md:115- Finding
Command Injection Through Unvalidated Shell Command Interpolation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 115–116 and 125–126
Vulnerability Type: Shell command injection
Risk Level: MediumVulnerable Code
text flyai search-tickets --event "{team_name} vs {opponent}" --date "{match_date}" --city "{city}" flyai search-tickets --attraction "{stadium_name} tour" --date "{date}" --city "{city}"text flyai search-flight --origin "{departure_city}" --destination "{city}" --dep-date "{date}" flyai search-hotels --city "{city}" --check-in "{date}" --nights {duration}Technical Analysis
The Skill instructs the Agent to interpolate user-controlled and remotely sourced values directly into shell-style
flyaicommands. Relevant values include:departure_city, which is supplied directly by the user.team_name, initially derived from user input.opponent,city, andstadium_name, which may originate from external API or Web Search content.date,match_date, andduration, which are not subject to documented strict format or range validation before command construction.
Wrapping placeholders in double quotes is not sufficient shell protection. If the resulting command is passed to a shell, double quotes still permit command substitution such as
$(command)and backtick expressions. A malicious value could also contain a closing quote followed by shell operators, allowing the attacker to alter the command structure.The Skill does not require a structured process API, positional argument array, shell escaping routine, character allowlist, or final-command validation. Consequently, an implementation following these instructions literally may expose arbitrary command execution.
Attack Path
-
An attacker invokes a travel-planning workflow and supplies a crafted field, such as a departure city containing a shell expression:
text $(malicious_command)Alternatively, the attacker could use quote termination and shell operators if the execu ...[truncated 1770 chars]
- Remediation
View remediation
Remediation Suggestions
-
Avoid shell-based execution. Invoke
flyaithrough a structured process API that accepts an executable and argument array, for example:text executable: flyai arguments: - search-flight - --origin - validated_departure_city - --destination - validated_destination - --dep-date - validated_dateDo not use
sh -c,bash -c, string concatenation, or equivalent shell evaluation. -
Validate every interpolated field.
- Require dates to match a strict
YYYY-MM-DDparser and reject invalid calendar dates. - Parse
durationandnightsas bounded positive integers rather than strings. - Restrict team, opponent, stadium, and city names to a reasonable length and expected Unicode letters, numbers, spaces, apostrophes, periods, and hyphens.
- Reject control characters, line breaks, NUL bytes, and unexpected shell metacharacters.
- Require dates to match a strict
-
Treat remote data as untrusted. Apply the same validation to ESPN and Web Search values as to direct user input. Do not assume API-derived names are safe command arguments.
-
Use robust escaping only as defense in depth. If shell execution is unavoidable, use a proven platform-specific escaping library for each argument. Manual quoting and simple character replacement are insufficient.
-
Require confirmation of sanitized values. Before ticket or travel searches, display the normalized event, city, date, and duration as data—not as a shell command—and obtain user confirmation where appropriate.
-
Run with least privilege. Execute travel-search tooling in a sandbox with minimal filesystem access, no unnecessary credentials, restricted environment variables, and constrained outbound network access.
-
Add adversarial tests. Test all command parameters with payloads containing command substitution, quotes, semicolons, pipes, redirection operators, backticks, newlines, and Unicode control characters. Verify they ...[truncated 60 chars]
-