T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:113- Finding
Shell Injection Through User-Controlled Values in Documented Bash Commands
- Content
View full analysis
--stop-loss <止损价> --account <账户总额> ``` ```bash python3 $SCRIPTS/aios.py init --account <账户总额> ``` ```bash python3 $SCRIPTS/aios.py log --type 买入 --ticker <代码> --price <价格> --reasons '<理由>' --stop-loss <止损> --target <目标> --emotion <情绪> ``` ```bash python3 $SCRIPTS/aios.py position --price <价格> --stop-loss <止损价> --account <账户总额> ``` ```bash python3 $SCRIPTS/aios.py log --type <类型> --ticker <代码> --price <价格> ``` ### Technical Analysis The Skill directs the agent to construct and execute Bash commands by substituting user-provided trading data directly into command templates. Fields such as ticker, transaction type, reasons, price, and account value are not accompanied by shell-safe encoding or strict input validation requirements. Most placeholders are entirely unquoted. Although the reasons field is surrounded by single quotes, a user-controlled single quote can terminate that quoted context. Shell separators, command substitutions, redirections, or other metacharacters may consequently be interpreted by Bash before `aios.py` receives the intended arguments. The Python script uses `argparse`, but this does not prevent the vulnerability: shell parsing occurs before Python starts. The weakness is therefore in the Skill's command-construction instructions rather than in `argparse`. ### Attack Path 1. The Skill asks the user for a ticker, transaction type, reason, price, or another value used in a documented Bash command. 2. A malicious or compromised input contains shell metacharacters. For the reasons argument, the input can first close the surrounding single-quoted string. 3. The agent substitutes the value into the command template without reliable shell esca ...[truncated 1019 chars]- Remediation
View remediation