T09 · Insecure Skill Coding Practices
Error
- Location
skill.yaml:37- Finding
Shell Command Injection Through Untrusted Essay Interpolation
- Content
View full analysis
threshold or metrics outside human range, run rewrite with targeted feedback 4. Re-measure after rewrite 5. Repeat until passing or max iterations reached 6. Output final essay + iteration report table ``` ### Technical Analysis The Skill requests the `shell` permission and directs the orchestrating agent to substitute user-controlled essay text into a quoted command-line argument: ```bash python skill/scripts/measure.py --text "ESSAY" ``` Shell quoting does not safely neutralize arbitrary untrusted content. An essay containing a double quote followed by shell syntax can terminate the intended argument and introduce another command. Command substitutions may also be evaluated inside double quotes by common shells. The Python script itself uses `argparse` safely, but that does not protect the command-construction layer. Exploitation occurs before Python receives the arguments. The vulnerability applies when the orchestrator follows the natural-language instruction by constructing a shell command as written rather than using an argument-array API. ### Attack Path 1. An attacker submits an essay containing shell metacharacters, quote termination, or command-substitution syntax. 2. The Skill activates because the user requests essay measurement or humanization. 3. The shell-enabled orchestrator substitutes the essay into the documented `--text "ESSAY"` command. 4. The shell interprets the injected syntax before invoking `measure.py`. 5. The injected command runs with the same operating-system privileges and filesystem access as the agent process. A conceptual malicious input could terminate the quoted argument, append another shell command, and comment out ...[truncated 809 chars]- Remediation
View remediation