T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:40- Finding
Command Injection Risk Through Unquoted User-Supplied Directory Paths
- Content
View full analysis
-type f` — list every file, note extensions and sizes. Read SKILL.md fully, including frontmatter. Read every script file. ``` ```bash # Code layer grep -rnE "eval\(|exec\(|os\.system|subprocess|child_process" grep -rnE "https?://[a-zA-Z0-9./?=_-]+" grep -rnE "\.env|\.ssh|Keychain|Credentials|\.aws|token|apikey" -i grep -rnE "[A-Za-z0-9+/=]{100,}" # SKILL.md layer grep -nE "curl .*\|.*(bash|sh)|wget .*\|" /SKILL.md ``` ### Technical Analysis The skill instructs an agent to replace `` with a user-provided skill-directory path and place that value directly into shell commands. The examples do not quote the substituted path, terminate command options, or require validation that the value is a canonical directory under an approved workspace. If an agent performs literal string substitution before invoking a shell, shell metacharacters in the supplied directory value—such as command separators, substitutions, redirections, or pipelines—can be interpreted as shell syntax rather than as part of a filesystem path. Values beginning with `-` can also be interpreted as command options. The `curl | bash` expression at `SKILL.md:56` is only a regular expression intended to detect unsafe installation instructions. It does not itself retrieve or execute a remote payload. ### Attack Path 1. An attacker persuades a user or agent to audit a purported skill using a crafted directory string containing shell syntax. 2. The agent substitutes the string directly for `` in one of the documented `find` or `grep` commands. 3. The agent executes the resulting command through a shell. 4. The shell parses the injected metacharacters and runs the attacker-selected command in addition to, or instead of, the i ...[truncated 1089 chars]- Remediation
View remediation