T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-image.sh:345- Finding
Shell Startup Command Injection Through Unsafely Persisted Configuration Values
- Content
View full analysis
&2 echo " Visit https://listenhub.ai/settings/api-keys" >&2 echo " (Requires subscription)" >&2 echo "" >&2 echo -n " Please paste your API key: " >&2 read -r api_key if [ -z "$api_key" ]; then echo "Error: API key cannot be empty" >&2 exit 1 fi # Check if config already exists (avoid duplicate append) if ! grep -q "^export LISTENHUB_API_KEY=" "$shell_rc" 2>/dev/null; then echo "export LISTENHUB_API_KEY=\"$api_key\"" >> "$shell_rc" else # If exists, replace sed_inplace "$shell_rc" "s|^export LISTENHUB_API_KEY=.*|export LISTENHUB_API_KEY=\"$api_key\"|" fi export LISTENHUB_API_KEY="$api_key" fi if [ -z "${LISTENHUB_OUTPUT_DIR:-}" ]; then echo "2. Output path" >&2 echo -n " Image save location (default: ~/Downloads): " >&2 read -r output_dir if [ -z "$output_dir" ]; then output_dir="$HOME/Downloads" fi output_dir="${output_dir/#\~/$HOME}" mkdir -p "$output_dir" if ! grep -q "^export LISTENHUB_OUTPUT_DIR=" "$shell_rc" 2>/dev/null; then echo "export LISTENHUB_OUTPUT_DIR=\"$output_dir\"" >> "$shell_rc" else sed_inplace "$shell_rc" "s|^export LISTENHUB_OUTPUT_DIR=.*|export LISTENHUB_OUTPUT_DIR=\"$output_dir\"|" fi export LISTENHUB_OUTPUT_DIR="$output_dir" fi ``` ### Technical Analysis The script inserts values obtained through `read` directly into `.bashrc`, `.zshrc`, or another shell startup file. The values are placed inside double-quoted shell assignments without shell-safe serialization or strict character validation. A value containing a closing quote and shell syntax can produce an executable command in the resulting startup file. Command substitutions retained in the genera ...[truncated 2014 chars]- Remediation
View remediation