T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:28
- Finding
- Shell command injection through unvalidated endpoint interpolation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:28-33, 60`; `references/workflow.md:5-9, 25`; `references/templates.md:23-27, 39, 58-62, 79` **Vulnerability Type**: Untrusted input used in shell-oriented command construction **Risk Level**: High ### Complete Code Snippet From `SKILL.md:28-33`: ```markdown 1. Start from user-provided host input: - record the raw host the user gives - normalize endpoint candidates (scheme/no-scheme, path variants) 2. Discover protocol and valid path before drafting skill text: - search official docs/repo to confirm endpoint shape and auth model - probe candidates with `uxc <endpoint> -h` ``` The generated template in `references/templates.md:23-27` repeats the unsafe pattern: ```markdown 1. Confirm endpoint/protocol/auth from user host: - search official docs for canonical endpoint and auth requirements - probe with `uxc <host> -h` (and endpoint variants if needed) 2. Use fixed link command by default: - `command -v <link_name>` - If missing, create it: `uxc link <link_name> <host>` ``` ### Technical Analysis The Skill explicitly starts with a raw, user-provided endpoint and places that value into shell-oriented command examples. It does not require URL parsing, character validation, shell escaping, or execution through an argument-vector API. If an Agent replaces `<host>` or `<endpoint>` with attacker-controlled text and executes the rendered command through a shell, shell metacharacters can terminate the intended `uxc` argument and introduce another command. Quoting alone would not be sufficient unless quoting and escaping are implemented consistently for the target shell. The validator also checks only whether these command patterns appear in generated documentation. It does not enforce safe endpoint validation or safe process invocation. ### Attack Path 1. An attacker supplies a crafted endpoint containing shell syntax, such as a URL followed by a command separator and an atta ...[truncated 1123 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse the supplied value with a URL parser before any command is constructed. 2. Permit only explicitly supported schemes, preferably `https`. 3. Reject control characters, whitespace, shell metacharacters, embedded credentials, and malformed hostnames. 4. Execute `uxc` through a process API using an argument array, for example the conceptual equivalent of `["uxc", validatedEndpoint, "-h"]`, without invoking a shell. 5. Do not recommend direct textual substitution of raw values into shell commands. 6. If shell execution cannot be avoided, apply shell-specific escaping and retain explicit quoting around every substituted value. 7. Update wrapper templates to use validated variables, such as: ```bash uxc -- "$validated_endpoint" -h ``` This should only be used if `uxc` supports `--`; argument-array execution remains preferable. 8. Extend generated validators to reject unquoted endpoint placeholders and require endpoint-validation guidance. 9. Add tests using endpoints containing spaces, quotes, semicolons, command substitutions, newlines, and leading hyphens. ]]>