T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:205
- Finding
- Unsafe interpolation and publication of untrusted diagnostic content in GitHub issue command<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 205–241 **Vulnerability Type**: Command injection and sensitive information disclosure **Risk Level**: High ### Vulnerable Code ```markdown 1. Prepare the issue content from the RepairContext you already have: - **Title:** `[autofix] <site>/<command>: <error_code>` (e.g. `[autofix] zhihu/hot: SELECTOR`) - **Body** (use this template): ```markdown ## Summary OpenCLI autofix repaired this adapter locally, and the retry passed. ## Adapter - Site: `<site>` - Command: `<command>` - OpenCLI version: `<version from opencli --version>` ## Original failure - Error code: `<error_code>` ~~~ <error_message> ~~~ ## Local fix summary ~~~ <1-2 sentence description of what you changed and why> ~~~ _Issue filed by OpenCLI autofix after a verified local repair._ ``` 2. **Ask the user before filing.** Show them the draft title and body. Only proceed if they confirm. 3. If the user approves and `gh auth status` succeeds: ```bash gh issue create --repo jackwener/OpenCLI \ --title "[autofix] <site>/<command>: <error_code>" \ --body "<the body above>" ``` ``` ### Technical Analysis The Skill instructs the agent to place values from `RepairContext`, including `<error_message>`, `<site>`, `<command>`, and `<error_code>`, directly into a shell command. These diagnostic values may originate from an untrusted website, API response, page content, or adapter failure. The generated issue body is embedded in a double-quoted Bash argument. The instructions do not require shell-safe encoding or use of a non-interpreted input channel. If an agent constructs the command by substituting the values into the command text, shell syntax in a malicious diagnostic message—such as command substitutions, embedded quotes, backticks, or control operators—can alter how the shell interprets the resulting command. The issue body can also contain sensitive diagnostic information. Error messages may expose authentica ...[truncated 2529 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Do not interpolate issue content into executable shell text.** - Write the issue body to a securely created temporary file. - Pass it with `gh issue create --body-file <path>`. - Supply the title and other values as separately escaped arguments rather than constructing a shell command through textual substitution. 2. **Use a safe argument-passing mechanism.** - Prefer direct process execution with an argument array when supported. - If Bash must be used, place dynamic values in environment variables or positional parameters and quote every expansion. - Do not use `eval`, command-string concatenation, or generated shell syntax. 3. **Redact diagnostics before displaying or submitting them.** - Remove authorization headers, cookies, API keys, access tokens, session identifiers, signed URLs, query parameters, email addresses, and other personal data. - Replace detected sensitive values with explicit placeholders such as `[REDACTED_TOKEN]`. - Include only the minimum error details required to reproduce the adapter defect. 4. **Treat all `RepairContext` fields as untrusted.** - Reject or encode control characters, embedded NULs, command substitutions, backticks, and unexpected newlines. - Validate the site, command, and error-code fields against restrictive allowlists before using them in a title or command argument. 5. **Strengthen user review.** - Show the final redacted title and body exactly as they will be submitted. - Warn the user that the issue may be public. - Require confirmation after redaction and immediately before network submission. 6. **Use a safer documented command pattern**, for example: ```bash tmp_body="$(mktemp)" trap 'rm -f "$tmp_body"' EXIT chmod 600 "$tmp_body" cat >"$tmp_body" <<'SAFE_ISSUE_BODY' <redacted and safely prepared issue body> SAFE_ISSUE_BODY gh issue create \ --repo jackwener/OpenCLI \ --title "$SAFE_TITLE" \ --body-file "$tmp_body" ``` ...[truncated 245 chars]