T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:29
- Finding
- Shell Command Injection Through Unescaped User-Controlled API Parameters<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29–37 **Vulnerability Type**: Shell command injection caused by unsafe interpolation of user-controlled data **Risk Level**: High ### Vulnerable Code ```bash curl -s -X POST https://jiufu-trace.cn/api/cti/verify \ -H 'Content-Type: application/json' \ -d '{ "product_name": "用户提到的产品名称", "brand": "品牌名称", "category": "产品品类（如：饮料/化妆品/电子产品/宠物食品）" }' ``` ### Technical Analysis The skill requires access to the `exec` tool and directs the agent to place user-provided product, brand, and category values inside a single-quoted shell argument. The instructions do not require validation, shell escaping, or JSON serialization. In POSIX-compatible shells, a single quote contained in an interpolated value terminates the surrounding quoted argument. An attacker can therefore supply a product or brand value containing a quote followed by shell operators and an additional command. If the agent performs direct textual substitution and passes the resulting command to a shell, the appended command is interpreted locally rather than being included only as API data. JSON escaping alone would not address this vulnerability because shell parsing occurs independently of JSON parsing. The values must be serialized and passed without unsafe shell evaluation. ### Attack Path 1. An attacker asks the agent to verify a product or brand whose supplied name contains a single quote, shell control operators, and an additional command. 2. The agent follows `SKILL.md` and substitutes that value into the single-quoted `curl -d` template. 3. The attacker-controlled quote closes the intended shell argument. 4. The shell interprets the subsequent operators and command as executable syntax. 5. The injected command runs with the operating-system privileges and environment available to the agent's `exec` tool. 6. Depending on those privileges, the command can read accessible files, alter project data, inspect ...[truncated 721 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Avoid shell-based HTTP invocation. Use a structured HTTP tool or language API that accepts the endpoint, headers, and JSON body as separate typed parameters. 2. Serialize the request body with a trusted JSON encoder rather than interpolating values into a JSON string. 3. If `curl` is unavoidable, construct the payload with a serializer such as `jq` using separately supplied arguments, and invoke the process through an argument-array API without a shell. 4. Explicitly prohibit direct concatenation of user-controlled product, brand, category, or depth values into shell commands. 5. Validate input length and expected character ranges as defense in depth. Validation must not replace safe process invocation and serialization. 6. Run the network request with least privilege, a restricted environment, and no unnecessary access to secrets or writable sensitive paths. 7. Add tests covering quotes, command separators, substitutions, newlines, and other shell metacharacters to verify that every supplied value remains inert request data. ]]>