T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:33- Finding
Shell Command Injection Through Zotero Search Terms
- Content
View full analysis
" --limit 10 ``` ### Technical Analysis The skill instructs the agent to place search terms inside a shell command represented as a command string. Search terms originate from the user's research topic and therefore cannot be trusted. Double quotes do not provide adequate protection when an untrusted value may itself contain quotation marks, command substitutions, or other shell metacharacters. If the agent constructs this text and executes it through a shell, crafted search terms can terminate the quoted argument and introduce additional shell syntax. The injected command would execute with the same operating-system identity and permissions as the agent process. ### Attack Path 1. An attacker supplies a research topic or keyword containing quotation marks and shell-control syntax. 2. The agent substitutes that value for `` without strict validation or shell-safe argument handling. 3. The resulting text is passed to a shell. 4. The shell interprets part of the supplied value as command syntax rather than as a single search argument. 5. Attacker-selected commands execute under the agent's local account. ### Impact Assessment Successful exploitation could permit arbitrary command execution with the agent's privileges. Depending on that account's access, an attacker could read or modify workspace files, access local Zotero data, obtain credentials available to the process, alter paper content, or invoke network-accessible resources. The instruction does not itself confer elevated operating-system privileges, so the ultimate scope is bounded by the executing account. ]]>- Remediation
View remediation