T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:89- Finding
Shell Command Injection Through Generated Content
- Content
View full analysis
{SKILL_DIR}/output/$(date +%Y-%m-%d)/prompts.json << 'EOF' EOF # Run the full pipeline python3 {SKILL_DIR}/scripts/video_pipeline.py create \ --prompts {SKILL_DIR}/output/$(date +%Y-%m-%d)/prompts.json \ --output {SKILL_DIR}/output/$(date +%Y-%m-%d) \ --text "" \ --bgm-dir {SKILL_DIR}/bgm \ --mood ``` ```bash python3 {SKILL_DIR}/scripts/xhs_publish.py video \ --title "" \ --content "" \ --video "{SKILL_DIR}/output/$(date +%Y-%m-%d)/final.mp4" \ --tags "" ``` ### Technical Analysis The Skill instructs the agent to substitute generated prompts, overlay text, titles, post content, tags, and mood values directly into shell command text. These values can be influenced by persona files, prompt templates, user input, or model-generated output. Double quotes do not prevent shell evaluation of command substitutions such as `$(command)` or backticks. Embedded quotation marks can also terminate an argument and introduce shell operators. In addition, a prompt containing a line equal to `EOF` can terminate the heredoc early, allowing subsequent lines to be interpreted as shell commands. The affected values are not passed through a structured process API, and the instructions do not require shell-safe quoting or input validation. ### Attack Path 1. An attacker introduces crafted content through a user-supplied topic, modified persona, prompt template, or other input used to generate the post. 2. The generated field contains shell syntax, such as a quote followed by a command separator, a command substitution, or a standalone `EOF` line. 3. The agent substitutes that field into one of the documented shell ...[truncated 776 chars]- Remediation
View remediation