T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:63- Finding
Shell Command Injection Through Unsafe Search Query Interpolation
- Content
View full analysis
", "freshness": "", "summary": true, "count": }' ``` The placeholders above correspond to the user search query, time range, and result count placeholders in the original Skill instructions. ### Technical Analysis The Skill instructs an Agent to extract a search query from user input and insert it into JSON embedded in a single-quoted shell argument. It does not require the Agent to use a JSON serializer, safe process argument API, or shell escaping. If an implementation performs direct textual substitution, a single quote in the search query can terminate the `curl -d` argument. Subsequent shell metacharacters can then introduce additional commands. JSON escaping alone is insufficient because shell parsing occurs before `curl` processes the JSON. The `freshness` and `count` placeholders are also interpolated into shell source. Although the document describes constrained values for them, implementations should validate these parameters rather than relying solely on the natural-language constraints. ### Attack Path 1. An attacker asks the Agent to search for a phrase containing a single quote followed by shell syntax, such as a value structurally equivalent to: ```text x'; attacker_command; # ``` 2. The Agent extracts the supplied phrase as the search query. 3. The Agent substitutes the query directly into the documented shell command. 4. The single quote terminates the intended `curl` data argument. 5. The shell interprets the remaining metacharacters and attacker-supplied command as executable syntax. 6. The injected com ...[truncated 983 chars]- Remediation
View remediation