T09 · Insecure Skill Coding Practices
Error
- Location
index.js:743- Finding
Shell Command Injection Through Unsanitized Tool Arguments
- Content
View full analysis
` ## Verifying your purchase You've signed and sent a payment. Now you need to tell the merchant about it. Run: \`\`\` curl "${merchant}/receipt/${productId}?tx=${tx}" \`\`\` ``` Additional affected commands include: ```js const TEST_PAYMENT = (merchantUrl) => { const url = merchantUrl || "https://underground.substratesymposium.com"; const isUnderground = url.includes("substratesymposium.com"); return ` ## Test-payment walkthrough Target merchant: **${url}** ### Step 1: Verify you can reach the merchant \`\`\` curl ${url}/catalog 2>/dev/null | head \`\`\` ``` ```js curl "${url}/deliver/continuity_fabric" ``` ```js curl -i "${url}/buy/am_i_creative_americano" ``` ### Technical Analysis The `merchant_url`, `product_id`, and `tx_hash` MCP arguments are interpolated directly into shell commands without validation or shell-safe encoding. The unquoted `${url}` in the catalog command permits ordinary shell metacharacters, including command separators, pipes, redirections, and whitespace-based argument injection. Quoting the other values does not fully resolve the issue because command substitutions such as `$(command)` and backtick substitutions remain active inside double-quoted shell strings. The MCP server does not execute these commands itself. Exploitation occurs when an AI agent or user trusts and executes the generated instructions, which is a realistic behavior for an instructional Skill designed to produce commands for agents. ### Attack Path 1. An attacker controls or influences a `merchant_url`, `product_id`, or `tx_hash` supplied to `test-payment` or `verify-my-purchase`. 2. The attacker embeds shell syntax such as command substitution or command separators in that va ...[truncated 1046 chars]- Remediation
View remediation