T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:170
- Finding
- Command Injection Risk in Dynamically Generated Scheduled Reminder Commands## Vulnerability Details **File Location**: `SKILL.md:170-184` **Vulnerability Type**: Shell command injection through unescaped dynamic reminder fields **Risk Level**: High ### Vulnerable Code ```text Use the WorkBuddy automation_update tool to create a one-time scheduled task. Parameters: - mode: "suggested create" - name: "Task reminder-{task name}" - scheduleType: "once" - scheduledAt: ISO 8601 format - status: "ACTIVE" - prompt: contains a curl command that directly calls the group robot Prompt template: Send a reminder message to the task group. Execute the following command: curl -s -X POST "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key={TASK_BOT_KEY}" -H "Content-Type: application/json" -d '{"msgtype":"markdown","markdown":{"content":"**Task reminder**\n\n> Task: <font color=\"warning\">{task name}</font>\n> Responsible person: {responsible person}\n> Deadline: {deadline}\n> Status: {status}\n\nPlease process it promptly!"}}' Report the result briefly after sending. ``` The snippet above is an English rendering of the command template at the specified source lines; its command structure and dynamic interpolation points are unchanged. ### Technical Analysis The Skill directs an agent to interpolate task names, responsible-party values, deadlines, and status values directly into a JSON document enclosed in a shell command argument. It does not require JSON serialization, shell escaping, input validation, or execution without a command shell. If any interpolated field contains a single quote, shell metacharacters, command substitution syntax, or crafted JSON delimiters, the value can terminate the `-d` argument and introduce additional shell commands. JSON escaping alone would not be sufficient because the resulting value must also remain safe for the shell quoting context. This risk is particularly significant because the command is saved in a scheduled automation prompt. Exploitation can ...[truncated 1337 chars]
- Remediation
- ## Remediation Suggestions 1. Do not store dynamically constructed shell commands in automation prompts. 2. Use a structured HTTP client or dedicated WeCom notification tool that accepts the URL and JSON body as separate typed parameters. 3. Serialize message bodies with a trusted JSON serializer rather than string concatenation. 4. If curl must be invoked, execute it through an argument array with shell processing disabled, such as `subprocess.run([...], shell=False)`. 5. Never place untrusted values inside a shell command string, even if JSON escaping has been applied. 6. Validate field length and expected character ranges before creating a reminder. 7. Store only a record identifier in the scheduled task where possible, then load and serialize the record safely when the reminder runs. 8. Add tests using quotes, newlines, semicolons, command substitutions, and malformed JSON to verify that user input cannot alter command structure.