T09 · Insecure Skill Coding Practices
Error
- Location
discovery.md:15- Finding
Shell Command Injection Through Unencoded Search Terms
- Content
View full analysis
&limit=20" | jq '.[].id' ``` ```bash curl -s "https://huggingface.co/api/datasets?search=&limit=20" | jq '.[].id' ``` ```bash curl -s "https://huggingface.co/api/spaces?search=&limit=20" | jq '.[].id' ``` ### Technical Analysis The discovery workflow instructs the agent to replace the `` placeholder inside executable shell command text. No requirement is provided to URL-encode the value or pass it to `curl` through a safely populated variable. Although the placeholder appears inside double quotes, shell substitutions such as `$(command)` and backtick command substitution are still evaluated within double-quoted strings when the resulting command is parsed by a shell. An attacker-controlled search term can therefore become executable shell syntax if the agent performs direct textual substitution before invoking the command. Characters such as quotes, semicolons, newlines, and shell substitutions may also modify the intended command structure. URL encoding alone is insufficient if it occurs only after unsafe shell parsing; the untrusted value must be supplied as data rather than inserted into shell source code. The same vulnerable construction is used for model, dataset, and Space discovery. ### Attack Path 1. An attacker asks the agent to search Hugging Face using a maliciously constructed term, such as a value containing `$(malicious_command)`. 2. The agent follows `discovery.md` and directly replaces `` with the supplied text. 3. The generated command is passed to a shell. 4. The shell evaluates the embedded command substitution before starting `curl`. 5. The injected command executes locally wi ...[truncated 995 chars]- Remediation
View remediation