T09 · Insecure Skill Coding Practices
- Location
SKILL.md:82- Finding
Shell Command Injection Through Unsafely Interpolated User Input
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 82-85, 94-97, 115-118, and 124-127
Vulnerability Type: Shell command injection caused by embedding user-controlled values in shell command templates
Risk Level: HighVulnerable Code
bash exec curl -s -X POST https://moltiguild-api.onrender.com/api/claim-starter \ -H "Content-Type: application/json" \ -d '{"userId": "USER_ID"}'bash exec curl -s -X POST https://moltiguild-api.onrender.com/api/smart-create \ -H "Content-Type: application/json" \ -d '{"task": "DESCRIBE THE TASK", "budget": "0.001", "userId": "USER_ID"}'bash exec curl -s -X POST https://moltiguild-api.onrender.com/api/mission/MISSION_ID/rate \ -H "Content-Type: application/json" \ -d '{"rating": RATING_1_TO_5, "userId": "USER_ID", "feedback": "OPTIONAL_FEEDBACK"}'bash exec curl -s -X POST https://moltiguild-api.onrender.com/api/create-pipeline \ -H "Content-Type: application/json" \ -d '{"guildId": 1, "task": "TASK", "budget": "0.005", "steps": [{"role": "writer"}, {"role": "reviewer"}], "userId": "USER_ID"}'Technical Analysis
The skill mandates execution of
curlthrough a shell while placing user-controlled task descriptions, feedback, mission identifiers, and user identifiers directly inside command templates. It does not require structured JSON serialization, shell-safe argument passing, or input validation.The JSON request bodies are enclosed in single quotes. If an implementation replaces the documented placeholders directly, an input containing a single quote can terminate the quoted request body. Shell metacharacters following that quote may then be interpreted as additional commands rather than request data.
For example, a malicious task or feedback value shaped like
' ; attacker_command ; #can break out of the intended JSON argument. JSON escaping alone is insufficient because shell parsing occurs ...[truncated 2130 chars]- Remediation
View remediation
Remediation Suggestions
- Replace shell-executed
curlcommands with a structured HTTP tool or language HTTP client that accepts the URL, headers, and body as separate typed arguments. - Serialize request bodies with a JSON library rather than manually assembling JSON strings.
- If shell execution is unavoidable, construct JSON with a safe serializer such as:
bash payload="$(jq -n \ --arg task "$TASK" \ --arg budget "$BUDGET" \ --arg userId "$USER_ID" \ '{task: $task, budget: $budget, userId: $userId}')" curl -sS -X POST 'https://moltiguild-api.onrender.com/api/smart-create' \ -H 'Content-Type: application/json' \ --data-binary "$payload" - Pass commands as an argument array without invoking a shell whenever the execution environment supports that option.
- Do not use
eval, nested command construction, or direct placeholder replacement in shell source. - Validate constrained fields before transmission:
- Require ratings to be integers from 1 through 5.
- Require budgets to match the permitted numeric format and range.
- Restrict mission, pipeline, and guild identifiers to their documented formats.
- Apply reasonable length limits to user IDs, tasks, and feedback.
- Add explicit instructions warning implementers that task descriptions and feedback are untrusted data and must never be interpolated into shell commands.
- Inform users that task descriptions, identifiers, and feedback are transmitted to an external service and should not contain credentials, private keys, confidential file contents, or other secrets.
- Run the skill with least privilege, a minimal environment, restricted filesystem access, and outbound network access limited to the documented API hosts to reduce impact if command handling fails.
- Replace shell-executed