T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:27
- Finding
- Potential Shell Command Injection Through Unvalidated Domain Substitution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27-32 **Vulnerability Type**: Shell command injection through unsafe handling of a user-supplied domain **Risk Level**: High ### Vulnerable Code ```bash # Check certificate for a domain openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issuer # Get detailed certificate information echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -text ``` ### Technical Analysis The Skill is intended to check certificates for “any domain,” so an agent using these examples is expected to replace `example.com` with a domain supplied by the user. Both occurrences of the domain are represented as unquoted shell tokens, and the instructions do not require validation before constructing and executing the command. If an implementation performs direct textual substitution and passes the resulting command to a shell, shell metacharacters in the supplied value can alter the command structure. This can permit command substitution, command chaining, redirection, or other unintended shell operations. The documented commands are static examples rather than executable scripts, so exploitation depends on an agent or downstream implementation substituting untrusted input directly into these templates. Nevertheless, the Skill promotes an unsafe command-construction pattern for its stated user-controlled input. ### Attack Path 1. An attacker asks the agent to check a purported domain containing shell syntax rather than a valid DNS name or IP address. 2. The agent replaces `example.com` in one of the documented command templates without validating or safely encoding the supplied value. 3. The agent executes the constructed text through a shell. 4. The shell interprets the injected metacharacters as command syntax. 5. The injected operation executes with the privileges and environment ...[truncated 784 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate the requested host before invoking any command: - Accept only valid DNS names, IPv4 addresses, or IPv6 addresses. - Reject whitespace, control characters, shell metacharacters, URL schemes, paths, and embedded port syntax. - Validate the port separately as an integer within the permitted range. 2. Avoid constructing a shell command by concatenating or interpolating user input. Invoke `openssl` with a subprocess API that accepts an argument array and does not enable shell evaluation. 3. If shell execution is unavoidable, apply robust shell quoting to every occurrence of the supplied value. Quoting should be treated as defense in depth rather than a replacement for strict host validation. 4. Update the Skill documentation to state explicitly that domain values are untrusted input and must never be inserted directly into shell command strings. 5. Prefer a safe implementation pattern equivalent to passing arguments separately: ```text ["openssl", "s_client", "-connect", validated_host_and_port, "-servername", validated_server_name] ``` 6. Add negative tests covering semicolons, command substitutions, pipes, redirections, newlines, spaces, option-like values, and malformed hostnames to ensure that such inputs are rejected before execution. ]]>