T09 · Insecure Skill Coding Practices
Error
- Location
- blueprint.md:18
- Finding
- Unsanitized Topic Slug Used in a Shell Command## Vulnerability Details **File Location**: `blueprint.md`, lines 18-21 **Vulnerability Type**: Command injection and path traversal **Risk Level**: High ### Vulnerable Code ```markdown For each active topic slug: ```bash mkdir -p ~/duolingo/topics/<topic-slug> ``` ``` ### Technical Analysis The Skill instructs the agent to place a topic-derived slug directly into an unquoted shell command. Topic names originate from user input during setup, as shown in `setup.md` lines 8-13, but the project does not define slug validation, canonicalization, shell escaping, or containment checks. If the placeholder is replaced directly with attacker-controlled content, shell metacharacters can introduce additional commands. Path separators or `..` components can also cause directory creation outside the intended `~/duolingo/topics/` hierarchy. ### Attack Path 1. A user starts setup and supplies a crafted topic name. 2. The agent converts or treats that topic name as the topic slug without strict validation. 3. The agent substitutes the value into: ```bash mkdir -p ~/duolingo/topics/<topic-slug> ``` 4. If the slug contains shell syntax, the shell may execute injected commands. If it contains traversal components, the resulting path may escape the intended topic directory. 5. The injected command or escaped path operates with the privileges of the process running the Skill. ### Impact Assessment Successful command injection could execute arbitrary commands with the agent process's operating-system privileges. This could permit unauthorized file creation, modification, or deletion and access to resources available to that account. Successful path traversal could create or target directories outside `~/duolingo/topics/`, violating the Skill's declared filesystem boundary. The practical scope is limited by the permissions of the account running the agent; the audited files do not demonstrate privilege escalation t ...[truncated 28 chars]
- Remediation
- ## Remediation Suggestions 1. Derive topic slugs using a strict allowlist, such as: ```regex ^[a-z0-9][a-z0-9-]{0,63}$ ``` 2. Reject slugs containing `..`, `/`, `\`, whitespace, control characters, shell metacharacters, or leading hyphens. 3. Prefer a filesystem API that accepts the destination as a path argument without invoking a shell. 4. Resolve and normalize the destination path, then verify that it remains a child of `~/duolingo/topics/`. 5. If shell execution is unavoidable, construct the validated path separately and pass it as a quoted argument: ```bash mkdir -p -- "$topic_path" ``` 6. Document explicit canonicalization behavior for user-facing topic names, including collision handling and rejection of invalid names. 7. Add tests covering command separators, command substitution, traversal sequences, absolute paths, leading options, and encoded separator variants.