T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:138- Finding
Unquoted User-Controlled TikTok Handle Enables Shell Command Injection
- Content
View full analysis
)" SEC_UID="$(echo "$JSON" | python3 -c 'import json,sys; print(json.load(sys.stdin)["sec_uid"])')" ``` ```bash DAEMON_OUT="$(tt-live.sh daemon --hours N --poll-min 5)" EVENTS_DIR="$(echo "$DAEMON_OUT" | awk -F= '/^events_dir=/{print $2}')" EVENTS_FILE="$EVENTS_DIR/$SEC_UID.events" ``` ### Technical Analysis The canonical workflow instructs an agent to substitute a requester-supplied TikTok handle directly into shell command text. The `` argument is neither quoted nor validated against the permitted TikTok handle syntax. If an agent performs textual substitution as documented, shell control operators, command substitutions, redirections, or other metacharacters included in the supplied value can become part of the generated shell program. This allows the value to change the command structure rather than remaining a single argument to `tt-live.sh`. For example, substituting a value containing a command separator could cause the generated command substitution to execute an additional local command: ```bash JSON="$(tt-live.sh check victim; touch /tmp/injected)" ``` The same unsafe pattern appears in both the one-shot identity check and daemon startup workflow. Exploitation depends on the consuming agent inserting requester-controlled text into the documented command verbatim, but the skill explicitly presents this as its canonical procedure. ### Attack Path 1. An attacker asks the agent to check or monitor a purported TikTok username containing shell syntax. 2. The agent substitutes that requester-controlled value for `` in the canonical workflow. 3. The agent executes the resulting shell command. 4. The shell interprets the injected syntax as part of the command structure. 5. The injected command e ...[truncated 974 chars]- Remediation
View remediation
&2 exit 2 ;; esac ``` 3. Enforce authoritative length limits in addition to the character allowlist. 4. Prefer a process-execution API that accepts an argument array rather than generating shell source. For example, invoke: ```text ["tt-live.sh", "check", validated_user] ``` 5. Harden `tt-live.sh` independently so that callers cannot bypass documentation-level validation. It should validate the username again, reject malformed or option-like values, and avoid `eval` or secondary shell parsing. 6. Validate numeric daemon parameters such as `--hours` and `--poll-min` as bounded integers before execution. 7. Add regression tests using values containing semicolons, command substitutions, redirections, whitespace, newlines, glob characters, and leading hyphens. Tests should verify that invalid handles are rejected without executing any secondary command. ]]>