T09 · Insecure Skill Coding Practices
- Location
SKILL.md:514- Finding
Shell Command Injection Through Unsafe Nested Command Construction
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:514-517
Vulnerability Type: Shell command injection
Risk Level: HighVulnerable Code
bash exec command=" SESSION_ID='$SESSION_ID' API_KEY='$API_KEY' # Poll until completionTechnical Analysis
The documented background workflow constructs a new shell command by directly interpolating
SESSION_IDandAPI_KEYinside single-quoted shell assignments. Neither value is shell-escaped before being embedded in the command string.A single quote contained in either value terminates the intended assignment. The remaining characters are then interpreted as shell syntax when the nested command is executed. For example, a value shaped like the following would break out of the assignment:
text '; attacker_command; #API_KEYoriginates from the environment and may be supplied by a user or surrounding automation.SESSION_IDoriginates from the remote API response. Exploitation therefore requires control over one of these inputs, such as a maliciously supplied API key, a compromised endpoint, or manipulated API response.Attack Path
- An attacker supplies a crafted
DESEARCH_API_KEY, or gains control over the API response used to populateSESSION_ID. - The value includes a single quote followed by shell syntax.
- The skill interpolates the value into the documented
exec command="..."string without shell-safe encoding. - The single quote closes the variable assignment.
- The nested shell parses and executes the injected command.
- The injected process inherits the operating-system privileges, accessible environment, filesystem access, and network access of the Agent process.
Impact Assessment
Successful exploitation permits arbitrary command execution under the account running the Agent. Depending on that account's permissions, an attacker could read or modify accessible files, steal environment cre ...[truncated 279 chars]
- An attacker supplies a crafted
- Remediation
View remediation
Remediation Suggestions
- Do not construct a nested shell program by interpolating untrusted values.
- Pass
SESSION_IDandAPI_KEYthrough the execution tool's environment-variable facility instead of embedding them inexec command. - Alternatively, pass values as positional arguments to a separately stored script.
- If dynamic shell construction is unavoidable, encode every interpolated value with a reliable shell-escaping mechanism such as
printf '%q'. - Validate
SESSION_IDagainst the narrowest expected format, such as a fixed-length hexadecimal or UUID pattern. - Avoid exposing the API key in command text because command strings may be captured in logs or process-management records.
- Run the workflow under a dedicated, least-privileged operating-system account with restricted filesystem and network access.