T09 · Insecure Skill Coding Practices
- Location
SKILL.md:67- Finding
Unvalidated command arguments can enable shell and JSON injection
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 67–81 and 100–103
Vulnerability Type: Command injection through unsafe command construction
Risk Level: HighVulnerable Code
bash REPORT_DIR="D:/amazon-mcp/reports/review-analysis/{ASIN}_{站点}_20260315" mkdir -p "$REPORT_DIR/data"bash API_KEY="从.mcp.json中获取的密钥" curl -s -X POST "https://mcp.sorftime.com?key=${API_KEY}" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"product_detail","arguments":{"amzSite":"US","asin":"ASIN"}}}' \ > "$REPORT_DIR/data/raw_product_sse.txt"bash curl -s -X POST "https://mcp.sorftime.com?key=${API_KEY}" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"product_reviews","arguments":{"amzSite":"US","asin":"ASIN","reviewType":"Negative"}}}' \ > "$REPORT_DIR/data/raw_reviews_sse.txt"Technical Analysis
The skill instructs an agent to incorporate the user-supplied ASIN and site into shell commands and JSON request bodies. It does not require validation before command construction. ASIN validation is only discussed later as troubleshooting after an API error.
Quoting a generated path does not make textual command generation safe. If an agent directly replaces
{ASIN}or{站点}with input containing shell syntax such as command substitution, that syntax can remain active inside a double-quoted assignment. Quotes embedded in an input can also terminate the single-quoted JSON passed tocurl, potentially exposing the surrounding shell command to injection.This vulnerability depends on the agent implementing the documented examples by textual substitution, which is the execution model explicitly described by the skill.
Attack Path
- An attacker invokes the skill with a malicious value in the ASIN or site argument.
- The agent substitutes the argum ...[truncated 1184 chars]
- Remediation
View remediation
Remediation Suggestions
-
Validate every argument before constructing paths, JSON, or shell commands:
- Require ASIN values to match
^[A-Za-z0-9]{10}$. - Require the site to be one of the documented fixed values:
US,GB,DE,FR,IN,CA,JP,ES,IT,MX,AE,AU,BR, orSA. - Reject control characters, whitespace, quotes, path separators, and shell metacharacters.
- Require ASIN values to match
-
Do not perform textual substitution into executable shell snippets. Use structured tool arguments or a subprocess API with an argument array and
shell=False. -
Construct request bodies with a JSON serializer. If Bash is unavoidable, use a safe tool such as:
bash jq -n \ --arg site "$SITE" \ --arg asin "$ASIN" \ '{jsonrpc:"2.0",id:1,method:"tools/call",params:{name:"product_detail",arguments:{amzSite:$site,asin:$asin}}}' -
Create output paths through a filesystem API rather than generated shell commands. Resolve the resulting path and verify that it remains under the intended report root.
-
Add explicit failure behavior: if validation fails, stop processing before any directory creation, API request, or command execution.
-