T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:34
- Finding
- Shell Command Injection Through Unsafely Interpolated User Input## Vulnerability Details **File Location**: `SKILL.md`, lines 34-37 **Vulnerability Type**: Shell command injection **Risk Level**: Critical ### Vulnerable Code ```sh curl -X POST http://{host}:{port}/{endpoint} \ -H "Content-Type: application/json" \ -H "Authorization: Bearer jqllxew" \ -d '{"user_id":"123456","message":"你好"}' ``` The same command-construction pattern is repeated in the examples at lines 48-52, 58-62, 73-77, and 82-86. ### Technical Analysis The skill directs the agent to construct a shell command using user-controlled recipient identifiers, message text, URLs, and local file paths. These values are placed inside a single-quoted shell argument. Ensuring that the resulting content is valid JSON is not equivalent to safely escaping it for a shell. If an input contains a single quote, it can terminate the `-d` argument. Subsequent shell metacharacters can then be interpreted as new commands. The skill states that it operates through local shell commands, so exploitation becomes possible whenever the generated command is executed by a shell. Host and port values should also be treated as untrusted unless they are obtained exclusively from a trusted configuration source. ### Attack Path 1. An attacker asks the agent to send a message containing a single quote followed by shell syntax. 2. The agent inserts the supplied message directly into the single-quoted `-d` argument. 3. The single quote closes the intended shell argument. 4. The shell parses the attacker's remaining input as shell operators and commands. 5. The injected command executes with the privileges of the process or account running the skill. ### Impact Assessment Successful exploitation can provide arbitrary command execution with the privileges of the local agent process. Depending on those privileges, an attacker could read local files, extract credentials, modify data, invoke unrelated network services, or install additi ...[truncated 106 chars]
- Remediation
- ## Remediation Suggestions - Do not generate or execute concatenated shell command strings. - Use a dedicated HTTP library and serialize the request body with a standard JSON encoder. - If `curl` must be invoked, use a process API that accepts an argument array and does not invoke a shell. - Pass the serialized JSON body as one argument rather than embedding it into shell source text. - Strictly validate recipient IDs using an allowlist appropriate for OneBot identifiers. - Restrict endpoints to the explicitly supported private-message and group-message paths. - Validate host and port values against trusted configuration or a strict allowlist. - Validate CQ parameters, URL schemes, and local file paths before use. - Add tests covering single quotes, command substitutions, newlines, shell metacharacters, and malformed CQ content.