T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:16
- Finding
- Unvalidated URL Substitution Can Enable Shell Command Injection## Vulnerability Details **File Location**: `SKILL.md`, line 16 **Vulnerability Type**: Shell command injection through unsafe input interpolation **Risk Level**: High ### Vulnerable Code ```bash # Extract webpage content and save it as a Markdown file curl -s https://r.jina.ai/<URL> > /tmp/web-content.md ``` ### Technical Analysis The documented workflow instructs the agent to substitute a user-provided URL directly into a shell command. It does not require URL validation, shell escaping, or use of a process execution interface that keeps arguments separate from shell syntax. If an implementation performs direct string substitution, shell metacharacters in the supplied value may terminate or modify the `curl` command. Merely quoting a URL is not a complete defense if the command is still assembled unsafely or evaluated through a shell. ### Attack Path 1. An attacker asks the agent to summarize a URL containing shell control characters or command substitution syntax. 2. The agent inserts the supplied value into the documented command template. 3. The resulting command is passed to a shell. 4. The shell interprets the injected syntax as an additional command rather than as part of the URL. 5. The injected command executes with the same operating-system privileges as the agent process. ### Impact Assessment Successful exploitation could permit arbitrary command execution within the agent's security context. The attacker could read or modify files accessible to the process, access environment variables and credentials, alter task output, invoke available tools, or perform network requests. The issue does not independently demonstrate privilege escalation beyond the agent's existing account.
- Remediation
- ## Remediation Suggestions - Accept only syntactically valid `http` or `https` URLs. - Reject embedded credentials, control characters, and unexpected URL schemes. - Parse the URL with a dedicated URL parser rather than regular-expression substitution. - Invoke `curl` through an argument-array API without a shell, for example by passing the URL as one isolated process argument. - Do not use `eval`, shell command concatenation, or equivalent dynamic interpretation. - Apply process sandboxing and restrict filesystem and network privileges to those required for retrieval.