T09 · Insecure Skill Coding Practices
Error
- Location
scripts/telegram-handler.js:98- Finding
Shell Command Injection Through Telegram Management Arguments
- Content
View full analysis
c.identifier === identifier); const name = contact ? contact.name : identifier; execSync(`node "${MANAGE_SCRIPT}" remove "${identifier}"`, { stdio: 'inherit' }); return `✅ Removed **${name}** (\`${identifier}\`) from watch list.\n\nRestart watcher to apply changes.`; } function handleDelay(identifier, minutes) { execSync(`node "${MANAGE_SCRIPT}" set-delay "${identifier}" ${minutes}`, { stdio: 'inherit' }); ``` Additional affected handlers use the same construction: ```javascript function handleSetTimeWindow(identifier, start, end) { try { execSync(`node "${MANAGE_SCRIPT}" set-time-window "${identifier}" "${start}" "${end}"`, { encoding: 'utf8' }); ``` ```javascript function handleAddKeyword(identifier, keyword) { try { execSync(`node "${MANAGE_SCRIPT}" add-keyword "${identifier}" "${keyword}"`, { encoding: 'utf8' }); ``` ```javascript function handleRemoveKeyword(identifier, keyword) { try { execSync(`node "${MANAGE_SCRIPT}" remove-keyword "${identifier}" "${keyword}"`, { encoding: 'utf8' }); ``` ```javascript function handleSetDailyCap(identifier, maxReplies) { try { execSync(`node "${MANAGE_SCRIPT}" set-daily-cap "${identifier}" ${maxReplies}`, { encoding: 'utf8' }); ``` The arguments originate directly from the command line: ```javascript const [,, command, ...args] = proces ...[truncated 2767 chars]- Remediation
View remediation