T09 · Insecure Skill Coding Practices
- Location
SKILL.md:170- Finding
Command Injection Risk in Dynamically Generated Scheduled Reminder Commands
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:170-184
Vulnerability Type: Shell command injection through unescaped dynamic reminder fields
Risk Level: HighVulnerable Code
text Use the WorkBuddy automation_update tool to create a one-time scheduled task. Parameters: - mode: "suggested create" - name: "Task reminder-{task name}" - scheduleType: "once" - scheduledAt: ISO 8601 format - status: "ACTIVE" - prompt: contains a curl command that directly calls the group robot Prompt template: Send a reminder message to the task group. Execute the following command: curl -s -X POST "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key={TASK_BOT_KEY}" -H "Content-Type: application/json" -d '{"msgtype":"markdown","markdown":{"content":"**Task reminder**\n\n> Task: <font color=\"warning\">{task name}</font>\n> Responsible person: {responsible person}\n> Deadline: {deadline}\n> Status: {status}\n\nPlease process it promptly!"}}' Report the result briefly after sending.The snippet above is an English rendering of the command template at the specified source lines; its command structure and dynamic interpolation points are unchanged.
Technical Analysis
The Skill directs an agent to interpolate task names, responsible-party values, deadlines, and status values directly into a JSON document enclosed in a shell command argument. It does not require JSON serialization, shell escaping, input validation, or execution without a command shell.
If any interpolated field contains a single quote, shell metacharacters, command substitution syntax, or crafted JSON delimiters, the value can terminate the
-dargument and introduce additional shell commands. JSON escaping alone would not be sufficient because the resulting value must also remain safe for the shell quoting context.This risk is particularly significant because the command is saved in a scheduled automation prompt. Exploitation can ...[truncated 1337 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not store dynamically constructed shell commands in automation prompts.
- Use a structured HTTP client or dedicated WeCom notification tool that accepts the URL and JSON body as separate typed parameters.
- Serialize message bodies with a trusted JSON serializer rather than string concatenation.
- If curl must be invoked, execute it through an argument array with shell processing disabled, such as
subprocess.run([...], shell=False). - Never place untrusted values inside a shell command string, even if JSON escaping has been applied.
- Validate field length and expected character ranges before creating a reminder.
- Store only a record identifier in the scheduled task where possible, then load and serialize the record safely when the reminder runs.
- Add tests using quotes, newlines, semicolons, command substitutions, and malformed JSON to verify that user input cannot alter command structure.