T09 · Insecure Skill Coding Practices
- Location
SKILL.md:28- Finding
Command Injection Through an Unsanitized Task Identifier
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 28; duplicated at line 47
Vulnerability Type: OS command injection
Risk Level: HighVulnerable Code
bash python3 ~/.workbuddy/skills/qclaw-workbuddy-bridge/scripts/qclaw_queue.py result <task_id>Technical Analysis
The skill instructs the agent to insert a task identifier supplied by the user directly into a shell command. It does not require validation, quoting, escaping, or execution through an argument-array API.
If the agent performs textual substitution and invokes the resulting command through a shell, shell metacharacters contained in the task identifier can be interpreted as command syntax rather than as part of a single argument. Relevant metacharacters include command separators, command substitutions, redirections, and pipelines.
The issue appears in both the core command documentation at line 28 and the task-ID-specific workflow at line 47. The external
qclaw_queue.pyimplementation is outside the audited project and was not available for review; therefore, this finding concerns the unsafe command construction prescribed by the skill documentation.Attack Path
- An attacker asks the agent to retrieve the result for a crafted task identifier containing shell syntax, such as a valid-looking identifier followed by a command separator and an additional command.
- Following the skill instructions, the agent substitutes the supplied value for
<task_id>. - The agent executes the constructed string using a shell-capable command tool.
- The shell parses the injected syntax and executes the attacker's additional command.
- The injected command runs with the same operating-system identity, filesystem permissions, environment access, and network access as the agent process.
Impact Assessment
Successful exploitation can permit arbitrary local command execution under the agent's account. Depending on that ...[truncated 648 chars]
- Remediation
View remediation
Remediation Suggestions
- Require task identifiers to match a strict allowlist appropriate to the queue format, for example
^[A-Za-z0-9_-]+$, and reject all nonconforming values. - Execute the utility without a shell by passing each argument separately, equivalent to:
python subprocess.run( [ "python3", os.path.expanduser("~/.workbuddy/skills/qclaw-workbuddy-bridge/scripts/qclaw_queue.py"), "result", task_id, ], check=True, shell=False, ) - Explicitly state in the skill instructions that user-provided task identifiers must never be concatenated into shell command strings.
- If a shell is unavoidable, validate the identifier first and apply robust platform-appropriate argument quoting. Quoting alone should not replace allowlist validation.
- Apply the same correction to both occurrences of the command at lines 28 and 47.
- Add negative tests using identifiers containing separators, substitutions, whitespace, redirections, and newline characters to verify that they are rejected or passed as one literal argument.
- Require task identifiers to match a strict allowlist appropriate to the queue format, for example