T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:153- Finding
Shell Command Injection Through Untrusted JSON Interpolation
- Content
View full analysis
` with the escaped JSON string, and read the API key from the `ZHIHUIAPI_KEY` environment variable: curl https://cc.zhihuiapi.top/v1/chat/completions \ -s \ -X POST \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${ZHIHUIAPI_KEY}" \ -d '{ "model": "claude-sonnet-4-6", "max_tokens": 2400, "response_format": {"type": "json_object"}, "messages": [ { "role": "system", "content": "" }, { "role": "user", "content": } ] }' ``` ### Technical Analysis The workflow requires the agent to substitute `` directly into a single-quoted shell argument passed to `curl`. The substituted object includes data originating from untrusted sources, including: - User-supplied topic keywords and writing-style instructions. - Zhihu question titles, excerpts, and URLs. - Zhihu comment text and author names. - Other externally controlled page content collected by the browser. Correct JSON escaping does not provide shell escaping. In particular, a single quote is valid inside a JSON string but terminates a single-quoted shell argument. If an untrusted value contains a single quote followed by shell syntax, the shell can interpret the remaining characters as commands rather than request data. The instruction to use an “escaped JSON string” does not define a safe shell-encoding procedure, nor ...[truncated 2287 chars]- Remediation
View remediation