T09 · Insecure Skill Coding Practices
- Location
SKILL.md:75- Finding
Shell Command Injection Through Unsafe JSON Interpolation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 75-78, 89-92, and 135-138
Vulnerability Type: Shell command injection caused by unsafe construction of JSON request bodies
Risk Level: HighVulnerable Code
Lines 75-78:
bash curl -s -X POST "https://jixietools.com/api/v1/products/PRODUCT_ID/calculate" \ -H "Content-Type: application/json" \ -d '{"inputs": {"有选项的参数名": ""}}'Lines 89-92:
bash curl -s -X POST "https://jixietools.com/api/v1/products/PRODUCT_ID/calculate" \ -H "Content-Type: application/json" \ -d '{"inputs": {"参数名1": "值1", "参数名2": "值2", ...}}'Lines 135-138:
bash curl -s -X POST "https://jixietools.com/api/v1/products/PRODUCT_ID/calculate" \ -H "Content-Type: application/json" \ -d '{"inputs": {"修改的参数名": "新值"}, "filename": "之前保存的filename"}'Technical Analysis
The skill instructs the agent to insert product identifiers, parameter names, parameter values, and a server-provided filename into shell command templates. The JSON body is enclosed in a single-quoted shell argument, but the instructions do not require JSON serialization, shell-safe argument handling, schema validation, or rejection of shell metacharacters.
If an implementation performs direct textual substitution, a user-controlled value containing a single quote can terminate the
-dargument. The remaining text can then be interpreted by the shell as additional syntax or commands. JSON escaping alone is not sufficient because JSON escaping does not protect shell quoting boundaries.The same weakness applies during initial calculation and incremental modification. The latter is particularly exposed because the workflow explicitly lets the user select a parameter and provide a new value.
The product identifier should also be validated as a numeric identifier before it is placed in the URL. Although it appears to originate from the product API, the documented template doe ...[truncated 1873 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace interpolated shell commands with a programmatic HTTP client such as Python
requestsorurllib. - Construct request bodies as native dictionaries and serialize them with a trusted JSON library:
python import requests payload = { "inputs": changed_inputs, "filename": filename, } response = requests.post( f"https://jixietools.com/api/v1/products/{product_id}/calculate", json=payload, timeout=30, ) response.raise_for_status() - If
curlmust be used, write JSON generated by a trusted serializer to standard input or a securely created temporary file. Invokecurlthrough an argument array withoutshell=True; never concatenate user-controlled text into a shell command. - Validate
PRODUCT_IDas an integer obtained from the trusted product-list response. - Accept parameter names only if they exactly match keys returned by the product-definition API.
- Validate values against the expected type, length, range, and allowed dropdown options before transmission.
- Treat
filenameas an opaque server-issued identifier and enforce a restrictive expected character pattern before reuse. - Add explicit instructions prohibiting direct substitution of user or API-controlled values into shell command strings.
- Apply HTTP timeouts, response-size limits, status validation, and bounded polling to reduce availability and resource-consumption risks.
- Replace interpolated shell commands with a programmatic HTTP client such as Python