T09 · Insecure Skill Coding Practices
- Location
SKILL.md:125- Finding
Shell Command Injection Through Unvalidated Scale Name and Download URL
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 125
Vulnerability Type: Shell command injection
Risk Level: HighVulnerable Code:
text 2. 使用 exec 下载：curl -L -o "/Users/wangyafei/Downloads/scales/[量表名]_official.pdf" "[PDF_URL]"Technical Analysis
The Skill instructs the Agent to construct and execute a shell command by directly substituting two untrusted values:
[量表名]originates from user input.[PDF_URL]is obtained from external web search results.
Neither value is validated, normalized, or safely escaped before being inserted into the command. Although the placeholders appear inside double quotes, a value containing a double quote followed by shell metacharacters can terminate the intended argument and append a new shell command.
The download URL is also not restricted to HTTPS or an allowlist of authoritative hosts. Redirect-following via
curl -Lfurther permits the initial server to redirect the request to an unexpected destination.This behavior exceeds minimum privilege because downloading a PDF does not require a general-purpose shell. A structured download API or a process invocation with a fixed executable and separate argument array would provide the required functionality with substantially less execution authority.
Attack Path
- An attacker supplies a crafted scale name containing quote characters and shell syntax, or causes a malicious URL to appear in the web-derived PDF result.
- The Agent substitutes the untrusted value into the documented
curlcommand. - The crafted value closes the quoted filename or URL argument.
- Appended shell metacharacters introduce an additional operating-system command.
- The Agent invokes the resulting string through
exec. - The injected command executes with the same filesystem, network, and process privileges as the Agent runtime.
Impact Assessment
Successful exploitation can provide arbitrary com ...[truncated 582 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace shell-based downloading with a structured HTTP client or dedicated download tool that accepts the URL and destination as separate typed parameters.
- If a subprocess is unavoidable, invoke
curlusing an argument array with shell interpretation disabled. - Restrict downloads to HTTPS URLs.
- Validate the final URL after every redirect and allow only approved authoritative domains.
- Derive filenames from a strict allowlist, such as ASCII letters, digits, periods, underscores, and hyphens.
- Generate the local filename independently rather than incorporating raw user input.
- Resolve and normalize the destination path, then verify that it remains within a configurable, user-approved download directory.
- Reject URLs containing embedded credentials, unexpected schemes, control characters, or malformed hostnames.
- Apply download size and content-type limits, and verify that the resulting file is actually a PDF rather than relying only on a minimum file-size check.
- Run the download operation with narrowly scoped filesystem and network permissions.