T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:139- Finding
Shell Command Injection Through Unsanitized User-Controlled Values
- Content
View full analysis
", "limit": 500}' \ -o .firecrawl//map-result.json ``` ```bash curl -s -X POST "https://api.firecrawl.dev/v1/crawl" \ -H "Authorization: Bearer $FIRECRAWL_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "", "limit": , "scrapeOptions": {"formats": ["markdown"]}}' \ -o .firecrawl//crawl-job.json ``` ```bash curl -s -X POST "https://api.firecrawl.dev/v1/scrape" \ -H "Authorization: Bearer $FIRECRAWL_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "", "formats": ["markdown"]}' \ -o .firecrawl//social/.json ``` ### Technical Analysis The skill instructs the agent to place user-provided URLs, project-derived slugs, page limits, and platform names directly into shell commands. It does not define validation, safe shell quoting, canonical path checks, or JSON serialization requirements. A URL containing a single quote can terminate the single-quoted JSON argument. Shell metacharacters appended after that point can introduce an additional command. The unquoted output paths create a second injection surface because shell metacharacters, substitutions, whitespace, or traversal sequences in a project slug or platform name can change command behavior or redirect output outside the intended cache directory. Although these examples are instructional templates rather than packaged executable scripts, agents following the skill are explicitly directed to execute the constructed commands. Therefore, unsafe interpolation can become command execution at runtime. ### Attack Path 1. An atta ...[truncated 1308 chars]- Remediation
View remediation