T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:68
- Finding
- Shell Command Injection Through Interpolated Session JSON<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:68` **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash echo '<session_json>' | python3 scripts/manage_profile.py data/kid-tutor/<name> log-session ``` ### Technical Analysis The documented workflow instructs the agent to embed session JSON directly inside a single-quoted shell command. Session data may contain attacker-controlled values, including questions, answers, notes, interests, or names. JSON escaping does not provide shell escaping. If a value contains a single quote, it can terminate the shell string. Subsequent shell metacharacters can then introduce an arbitrary command. The shell interprets that command before the JSON is passed to `manage_profile.py`. For example, a malicious session field could contain a payload shaped like: ```text '; <attacker-command>; echo ' ``` If substituted directly into `<session_json>`, this closes the quoted argument and causes the shell to execute the inserted command. ### Attack Path 1. An attacker supplies crafted text during a tutoring session, such as a question response or note containing a single quote followed by shell syntax. 2. The attacker-controlled text is included in the session JSON. 3. The agent follows the documented command and substitutes the JSON into the single-quoted `echo` expression. 4. The crafted single quote terminates the intended shell string. 5. The shell executes the injected command before or alongside `manage_profile.py`. 6. The injected process inherits the permissions and environment of the agent executing the skill. ### Impact Assessment Successful exploitation permits arbitrary command execution with the privileges of the agent or user running the skill. Depending on those privileges, an attacker could: - Read or modify files accessible to the agent. - Exfiltrate locally available profile, session, or configuration data. - Corrupt or delete learning records. - Ex ...[truncated 320 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Do not interpolate JSON or any other user-controlled value into a shell command. 1. Serialize session data using a structured JSON API and write it to a securely created file. 2. Invoke the script using an argument array rather than a shell: ```text ["python3", "scripts/manage_profile.py", "data/kid-tutor/<name>", "log-session", "--file", "<trusted-file>"] ``` 3. If standard input is required, start the Python process without a shell and pass the serialized JSON directly through the subprocess API's stdin facility. 4. Treat the child name used in the data path as untrusted input. Resolve it beneath an approved base directory and reject path separators, traversal components, and control characters. 5. Update `SKILL.md` to explicitly prohibit shell interpolation and provide only the safe invocation pattern. 6. Add regression tests using session values containing single quotes, semicolons, command substitutions, newlines, and shell metacharacters. ]]>