T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:79- Finding
Command Injection Through User-Controlled Accounting Fields
- Content
View full analysis
\ --type \ --category <分类> \ --note "<备注>" \ --date # 可选，默认今天 ``` ### Technical Analysis The skill instructs the Agent to construct and execute a shell command by interpolating transaction fields derived from user input. The `category` value is not quoted, while the `note` value is only enclosed in double quotes. Manual double quoting is insufficient when the value itself can contain quotation marks, command substitutions, backticks, or other shell metacharacters. Shell interpretation occurs before `record_bill.py` starts. Consequently, the Python `argparse` declarations and type checks cannot prevent this issue. A maliciously crafted category or note could terminate the intended argument and append another shell command. This vulnerability applies when the Agent follows the documented command template through a shell and performs direct textual substitution. Structured process invocation with a separate argument array would not have this weakness. ### Attack Path 1. An attacker submits an accounting request containing a crafted note or category with shell syntax. 2. The Agent extracts that attacker-controlled value as the transaction note or category. 3. The Agent substitutes the value into the command documented in `SKILL.md`. 4. The command is passed to a shell for execution. 5. The shell interprets injected separators, substitutions, or redirections instead of treating the entire value as inert data. 6. The injected command executes with the same operating-system privileges and filesystem access as the Agent process. ### Impact Assessment Successful exploitation can provide arbitrary command execution under the Agent's operating-system account. The ...[truncated 431 chars]- Remediation
View remediation