T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:99- Finding
Command Injection Through Unvalidated ASIN Shell Argument
- Content
View full analysis
/scripts/grade.py ``` ### Technical Analysis The Skill instructs the agent to substitute an ASIN obtained from scraper results directly into a shell command. Neither the ASIN nor the script path is quoted, validated, or passed through an argument-safe process execution interface. Although legitimate Amazon ASINs consist of ten alphanumeric characters, the workflow does not enforce this format. If the scraper response is compromised, manipulated, or otherwise contains an attacker-controlled ASIN value, shell metacharacters such as `;`, `&&`, command substitutions, or redirection operators could be interpreted by the shell. For example, an unsafe substituted value conceptually equivalent to: ```text B000000000; attacker_command ``` would cause the shell to treat the appended text as a separate command rather than as an argument to `grade.py`. ### Attack Path 1. The agent scrapes an Amazon SERP through the configured scraping service. 2. A compromised service, manipulated response, or malicious upstream data supplies a crafted value in `parsed.results[].asin`. 3. The agent selects that result as one of the top five organic products. 4. The crafted value is substituted into the documented `uv run ... grade.py ` shell template. 5. The shell interprets embedded metacharacters and executes an attacker-selected command. 6. The injected command runs with the same operating-system privileges and environment access as the agent process. ### Impact Assessment Successful exploitation may provide arbitrary command execution under the agent's operating-system identity. The resulting scope can include: - Reading files accessible to the agent account. - Accessing environment variables and locally available credential ...[truncated 362 chars]- Remediation
View remediation
&2 exit 1 fi uv run "$AMAZON_LISTING_JUDGE_DIR/scripts/grade.py" "$ASIN" ``` Additional hardening measures: 1. Use an argv-based process API rather than constructing a command string for shell evaluation. 2. Do not invoke a shell unless shell functionality is strictly required. 3. Resolve the grading script from a trusted, fixed installation directory. 4. Quote all shell variables, including file-system paths. 5. Do not trust scraper output merely because a field is named `asin`. 6. Run the grading process with least privilege, a minimal environment, and restricted file-system and network access. 7. Log validation failures without recording sensitive environment values. ]]>