T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:404- Finding
Shell Command Injection Through Inline User-Controlled JSON
- Content
View full analysis
'' ``` ``` The same unsafe argument pattern is used for employee updates: ```bash - Push updated employees.json: `update-employees.sh ''` ``` ### Technical Analysis The Skill instructs the Agent to insert generated JSON directly into a shell command as a single-quoted argument. That JSON can contain data originating from untrusted CSV files and user messages, including: - Employee names - Email addresses - CSV comments - Employee `info` fields - Company and roster text A single quote inside any attacker-controlled value terminates the shell's quoted string before either script begins execution. Additional shell syntax can then be interpreted as a separate command. For example, an attacker-controlled text value conceptually shaped like: ```text '; attacker-command; # ``` can break out of the intended JSON argument if the Agent substitutes it directly into the documented command template. The scripts validate JSON after startup, but this does not mitigate the vulnerability. Shell parsing and command substitution occur before `push-to-github.sh` or `update-employees.sh` receives its arguments. Consequently, injected commands can execute even when the remaining JSON is invalid. The underlying scripts already support file and standard-input modes, but the primary Skill instructions repeatedly require the unsafe inline-argument form. ### Attack Path 1. An attacker submits a CSV containing a crafted name, comment, email address, or other textual field with a single quote and shell metacharacters. 2. The Agent parses the value and includes it in roster JSON or ...[truncated 1368 chars]- Remediation
View remediation