T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:1380- Finding
Unsanitized User-Controlled Topic Interpolation in Shell Commands
- Content
View full analysis
/dev/null && COMPILER=xelatex || which pdflatex 2>/dev/null && COMPILER=pdflatex # Chinese content requires xelatex $COMPILER -review.tex bibtex -review $COMPILER -review.tex $COMPILER -review.tex # Run twice to resolve citations ``` ```bash # Basic DOCX conversion pandoc -review.md \ --from markdown \ --to docx \ --reference-doc ~/.claude/skills/sciverse-review/templates/reference.docx \ --bibliography -review.bib \ --csl ~/.claude/skills/sciverse-review/csl/.csl \ -o <topic>-review.docx ``` ```bash pandoc <topic>-review.md \ --from markdown \ --to pdf \ --pdf-engine=xelatex \ --bibliography <topic>-review.bib \ --csl ~/.claude/skills/sciverse-review/csl/<style>.csl \ -V CJKmainfont="PingFang SC" \ -V geometry:margin=2.5cm \ -o <topic>-review.pdf ``` ### Technical Analysis The skill derives `<topic>` from the user's requested review subject and uses it to construct filenames passed to shell commands. The instructions do not require the topic to be normalized, validated, escaped, or shell-quoted before substitution. If an agent replaces `<topic>` with the original user-controlled text and executes the resulting command through a shell, metacharacters such as semicolons, command substitutions, redirection operators, or shell control operators may be interpreted as command syntax rather than as part of a filename. The same unsafe pattern affects the LaTeX, BibTeX, DOCX, and PDF conversion paths. The `<style>` placeholder is also unquoted and should be constrained to the documented allowlist, although the confirmed primary input path is the user-supplied topic. This issue does not itself provide privilege escalation. Su ...[truncated 1722 chars]- Remediation
View remediation
apa-7th-edition.csl ieee -> ieee.csl vancouver -> vancouver.csl chicago -> chicago-author-date.csl mla -> modern-language-association-9th-edition.csl gbt -> gb-t-7714-2015-numeric.csl ``` 6. **Separate display titles from filesystem names** Preserve the original topic only inside document content. Never reuse the display title as a command argument or filesystem path without normalization. 7. **Apply least privilege** Run document-conversion tools in a restricted working directory under an unprivileged account, with only the filesystem and network access required for report generation. ...[truncated 5 chars]