T09 · Insecure Skill Coding Practices
Error
- Location
- command-paths.md:19
- Finding
- Command Injection Through Unsafe Interpolation of Map Parameters<![CDATA[ ## Vulnerability Details **File Location**: `command-paths.md`, lines 19-21; related construction instructions in `operation-patterns.md`, lines 6-9 and 18-21 **Vulnerability Type**: OS command injection caused by unsafe handling of user-controlled URL parameters **Risk Level**: High ### Vulnerable Code Snippet ```bash open -a Maps "https://maps.apple.com/?q=coffee+near+me" open -a Maps "https://maps.apple.com/?q=restaurants&near=Madrid" open -a Maps "https://maps.apple.com/?saddr=Cupertino&daddr=San+Francisco&dirflg=d" ``` The associated operation instructions direct the agent to substitute user-controlled values into these commands: ```markdown ## Place Search Pattern 1. Confirm search query text. 2. Ask for area context if the request is ambiguous. 3. Build URL with `q` and optional `near`. 4. Show preview URL and launch with `open -a Maps`. 5. Confirm expected result type after launch. ``` ```markdown ## Route Pattern 1. Confirm origin (`saddr`) and destination (`daddr`). 2. Confirm route mode (`dirflg`: driving, walking, transit). 3. Build URL and show preview before launch. 4. Launch in Maps and verify mode/destination match intent. ``` ### Technical Analysis The skill instructs the agent to construct a shell command by inserting user-provided search text, area names, route origins, and destinations into an Apple Maps URL. It does not require RFC 3986 percent-encoding, strict input validation, or invocation through an API that passes arguments directly without a shell. Wrapping the URL in double quotes is insufficient when untrusted text is interpolated into a shell command. Shell constructs such as `$(...)` and backtick command substitutions remain active inside double-quoted strings. Embedded quotation marks or newline characters may also alter the intended command structure. For example, if an implementation inserts a malicious query such as `$(malicious_command)` directly into the documented template, the resulting command can tak ...[truncated 1774 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Avoid shell-based execution.** Invoke `open` through a process API that accepts an argument array: ```text executable: /usr/bin/open arguments: ["-a", "Maps", generated_url] shell: false ``` 2. **Percent-encode every user-controlled URL component.** Encode `q`, `near`, `saddr`, `daddr`, `ll`, and other values with a standards-compliant URL builder rather than string concatenation. 3. **Validate the completed URL.** Require: - Scheme exactly equal to `https`. - Host exactly equal to `maps.apple.com`. - Only documented parameter names. - No control characters, newlines, or embedded credentials. - A reasonable maximum length. 4. **Do not rely on double quotes as sanitization.** If a shell cannot be avoided, use platform-appropriate argument escaping in addition to URL encoding and reject shell-sensitive constructs. Direct non-shell execution remains the preferred control. 5. **Update the operation documentation.** Explicitly state that user input must never be inserted into a command template before encoding and that the command must be launched without shell evaluation. 6. **Add adversarial tests.** Test query and route values containing command substitutions, backticks, quotation marks, ampersands, semicolons, newlines, Unicode control characters, and percent-encoded equivalents. Verify that these values remain inert URL data and cannot create additional commands. ]]>