T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:139
- Finding
- Shell Command Injection Through Unsanitized User-Controlled Values<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 139-178 **Vulnerability Type**: Shell command injection through unsafe interpolation **Risk Level**: High ### Vulnerable Code ```bash curl -s -X POST "https://api.firecrawl.dev/v1/map" \ -H "Authorization: Bearer $FIRECRAWL_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "<website-url>", "limit": 500}' \ -o .firecrawl/<project-slug>/map-result.json ``` ```bash curl -s -X POST "https://api.firecrawl.dev/v1/crawl" \ -H "Authorization: Bearer $FIRECRAWL_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "<website-url>", "limit": <N>, "scrapeOptions": {"formats": ["markdown"]}}' \ -o .firecrawl/<project-slug>/crawl-job.json ``` ```bash curl -s -X POST "https://api.firecrawl.dev/v1/scrape" \ -H "Authorization: Bearer $FIRECRAWL_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "<url>", "formats": ["markdown"]}' \ -o .firecrawl/<project-slug>/social/<platform>.json ``` ### Technical Analysis The skill instructs the agent to place user-provided URLs, project-derived slugs, page limits, and platform names directly into shell commands. It does not define validation, safe shell quoting, canonical path checks, or JSON serialization requirements. A URL containing a single quote can terminate the single-quoted JSON argument. Shell metacharacters appended after that point can introduce an additional command. The unquoted output paths create a second injection surface because shell metacharacters, substitutions, whitespace, or traversal sequences in a project slug or platform name can change command behavior or redirect output outside the intended cache directory. Although these examples are instructional templates rather than packaged executable scripts, agents following the skill are explicitly directed to execute the constructed commands. Therefore, unsafe interpolation can become command execution at runtime. ### Attack Path 1. An atta ...[truncated 1308 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not construct shell commands by interpolating user-controlled values. 2. Prefer a native HTTP client that accepts the URL, headers, request body, and output path as separate structured arguments. 3. If `curl` must be used, create JSON with a serializer such as: ```bash payload="$(jq -n --arg url "$website_url" --argjson limit "$limit" \ '{url: $url, limit: $limit}')" curl --data-binary "$payload" ... ``` 4. Normalize project and platform identifiers to a strict allowlist, such as `^[A-Za-z0-9_-]+$`. 5. Parse page limits as bounded integers rather than inserting arbitrary text. 6. Resolve and canonicalize every output path, then verify that it remains under the expected `.firecrawl/` directory. 7. Quote every filesystem path passed to the shell. 8. Reject URLs containing unsupported schemes and allow only `https://` or explicitly approved `http://` destinations. 9. Add tests with quotes, command substitutions, semicolons, newlines, whitespace, and traversal sequences. ]]>