T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:56
- Finding
- Shell Command Injection Through Unsafely Interpolated Note Input## Vulnerability Details **File Location**: `SKILL.md:56-57` and `SKILL.md:92-93` **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash grep -rn --include='*.md' -i 'SEARCH_TERM' $NOTES/ ``` ```bash echo -e "\n## New section\n\nContent to add" >> $NOTES/PATH_TO_NOTE.md ``` ### Technical Analysis The documented shell templates place user-derived search terms and note content directly into shell command syntax. They do not define validation or a safe mechanism for passing these values as command arguments or standard input. If an agent replaces `SEARCH_TERM` directly inside the single-quoted argument, an input containing a single quote can terminate the intended argument and introduce shell operators and commands. Likewise, note content placed directly inside the double-quoted `echo` argument can contain command substitutions such as `$()` or backticks, which the shell evaluates before invoking `echo`. The vulnerability arises because shell quoting embedded in a command template is not a substitute for context-aware argument handling. User-controlled values must not be concatenated into executable shell syntax. ### Attack Path 1. An attacker asks the skill to search for a deliberately crafted search term or append deliberately crafted content. 2. The agent substitutes the supplied value into the documented shell template. 3. For search, the payload closes the single-quoted string and adds a shell operator followed by an attacker-selected command. 4. For append, a command-substitution expression embedded in content is evaluated by the shell while constructing the `echo` argument. 5. The injected command runs with the same operating-system privileges and environment access as the agent process. ### Impact Assessment Successful exploitation can execute arbitrary local commands with the privileges of the agent runtime. This may permit reading or modifying files accessible ...[truncated 250 chars]
- Remediation
- ## Remediation Suggestions - Do not construct shell commands by inserting user-controlled strings into command text. - Prefer a filesystem or process-execution API that accepts an argument array without invoking a shell. - If shell execution is unavoidable, pass the search term as a positional parameter and use an end-of-options marker, such as `grep ... -- "$term" "$NOTES/"`. - Send note content through safely bound standard input rather than embedding it in an `echo` command. - Use `printf '%s\n' "$content"` instead of `echo -e`, while ensuring that `content` is supplied as data rather than inserted into generated shell source. - Treat all titles, tags, search terms, paths, and note bodies as untrusted input. - Add tests containing single quotes, semicolons, newlines, `$()`, backticks, redirection operators, and shell metacharacters to verify that they are handled only as literal data.