T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:17- Finding
Shell Command Injection Through Unquoted User-Controlled Arguments
- Content
View full analysis
` if it is missing from their request. Do not guess it. 3. **Execute Command**: - Construct and run the following terminal command (replacing placeholders with extracted values): `python main.py process -d ` ``` ### Technical Analysis The skill instructs the Agent to interpolate the user-controlled `keyword` and directory directly into a terminal command. It does not require shell-free execution, argument-array construction, escaping, quoting, or input validation. Both inputs may contain shell metacharacters. This is especially significant for the keyword because semicolons are explicitly accepted as keyword separators, while a shell also interprets a semicolon as a command separator. If the Agent invokes the resulting string through a shell, crafted input can change the command's structure rather than remaining a literal argument. The Python `argparse` implementation does not mitigate this issue because shell parsing occurs before `main.py` receives its arguments. ### Attack Path 1. An attacker supplies an invoice-processing request with a crafted keyword or directory containing shell syntax. 2. The Agent follows `SKILL.md` and directly substitutes the attacker-controlled value into the documented command string. 3. The Agent runs that string through a terminal shell. 4. The shell ...[truncated 720 chars]- Remediation
View remediation