T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:58- Finding
Shell Command Injection Through User-Controlled Company Argument
- Content
View full analysis
" --output json ``` ### Technical Analysis The documented workflow instructs the Agent to place a user-provided company name or stock code directly into a shell command executed through the `exec` tool. Enclosing the value in double quotes does not prevent shell evaluation of command substitutions such as `$(...)` or backticks. A value containing a closing quote can also escape the intended argument and introduce additional shell syntax. The Python script itself uses `argparse` and does not invoke a shell. The vulnerability arises from the command construction prescribed in `SKILL.md`, before the value reaches the script. ### Attack Path 1. An attacker submits a crafted company name containing shell syntax, such as `$(id)`. 2. The Agent substitutes that value into the documented command: ```bash python3 scripts/get_company_products.py --company "$(id)" --output json ``` 3. If `exec` processes the command through a shell, the shell evaluates the substitution before launching Python. 4. The injected command runs under the operating-system identity and permissions assigned to the Agent. 5. A malicious payload could subsequently read accessible files, inspect environment variables, modify writable resources, or transmit accessible information over the network. ### Impact Assessment Successful exploitation permits arbitrary command execution within the Agent runtime. The attacker may obtain access to files, environment variables, credentials, and network capabilities available to the Agent account, including the optional `TUSHARE_TOKEN` if present in the process environment. This issue does not independently elevate privileges beyond the Agent account. Its scope is bounded by that account's filesystem ...[truncated 241 chars]- Remediation
View remediation