T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:52
- Finding
- Shell Command Injection Through Unescaped User-Controlled Input<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:52`, `SKILL.md:60`, `SKILL.md:67`, `SKILL.md:74`, `SKILL.md:80-81`, `SKILL.md:108`, `SKILL.md:151`, `SKILL.md:173`, and `SKILL.md:180` **Vulnerability Type**: OS command injection through unsafe Bash interpolation **Risk Level**: High ### Vulnerable Code ```bash agent-browser open "https://news.google.com/search?q=INDUSTRY_EN&hl=en-US&gl=US&ceid=US:en" ``` ```bash agent-browser open "https://hn.algolia.com/?q=INDUSTRY_EN&dateRange=pastMonth&type=story" ``` ```bash agent-browser open "https://www.reddit.com/search/?q=INDUSTRY_EN&t=month&sort=relevance" ``` ```bash agent-browser open "https://www.bing.com/news/search?q=INDUSTRY_EN&freshness=Month" ``` ```bash agent-browser open "https://techcrunch.com/search/INDUSTRY_EN" agent-browser open "https://www.producthunt.com/search?q=INDUSTRY_EN" ``` ```bash agent-browser open COMPETITOR_URL agent-browser wait --load networkidle --timeout 3000 agent-browser snapshot -c ``` ```bash agent-browser open COMPETITOR_URL/blog # or /news /press /updates /articles agent-browser snapshot -c ``` ```bash agent-browser open COMPETITOR_URL/pricing agent-browser snapshot -c ``` ```bash agent-browser open COMPETITOR_URL/changelog # or /release-notes /whats-new /announcement agent-browser snapshot -c ``` ### Technical Analysis The skill directs the agent to derive `INDUSTRY_EN` and `COMPETITOR_URL` from user input and insert those values into commands executed through Bash. It does not require strict validation, safe argument passing, or shell escaping. The competitor URL placeholders are entirely unquoted. Consequently, Bash metacharacters such as semicolons, pipes, redirection operators, command substitutions, and logical operators may be interpreted as shell syntax rather than as part of a URL. The industry value is placed inside double quotes, but double quotes do not suppress command substitution through `$()` or backticks. A malicious industry value ...[truncated 2114 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not construct shell command strings using user-controlled data. Invoke `agent-browser` through an execution interface that accepts an argument array without invoking a shell, such as an equivalent of: ```text ["agent-browser", "open", validated_url] ``` 2. If Bash cannot be avoided, pass validated data as a positional argument rather than interpolating it into executable shell text. Do not rely on double quotes alone for protection. 3. Construct search URLs with a URL-building library: - Translate the industry term as data. - Percent-encode it as a query parameter or path segment. - Reject control characters and unexpected delimiters. - Pass the completed URL as one non-shell argument. 4. Validate competitor and brand URLs before use: - Require an absolute `https://` URL. - Parse it with a URL parser rather than regular-expression concatenation. - Reject credentials in URLs, control characters, whitespace, and unsupported ports. - Never append paths through raw string concatenation; use a URL resolver. 5. Add explicit skill instructions prohibiting direct interpolation of `INDUSTRY_EN`, `COMPETITOR_URL`, and `YOUR_BRAND_URL` into Bash commands. 6. Harden tool authorization so it validates the parsed executable and arguments rather than accepting any shell command beginning with `agent-browser`. 7. Add regression tests containing spaces, quotes, semicolons, pipes, backticks, `$()`, newlines, redirections, and option-like URL values. Verify that each value is either rejected or passed as inert data. ]]>