T09 · Insecure Skill Coding Practices
Error
- Location
scripts/script.sh:8- Finding
Shell Command Injection in Generated Vercel Commands
- Content
View full analysis
"; exit 1; } cat << EOF # Check deployment status for: $project # Run this command (replace YOUR_TOKEN with your Vercel token): curl -s "$VERCEL_API/v9/projects/$project" \\ ``` Additional affected command generation includes: ```bash cmd_list() { local limit="${1:-10}" cat << EOF # List recent $limit deployments # Run this command: curl -s "$VERCEL_API/v6/deployments?limit=$limit" \\ ``` ```bash cmd_logs() { local project="${1:-}"; local dep_id="${2:-latest}" [[ -z "$project" ]] && { echo "Usage: logs [deployment-id]"; exit 1; } cat << EOF # Step 1: Get latest deployment ID for $project curl -s "$VERCEL_API/v9/projects/$project" \\ ``` ```bash cmd_domains() { local project="${1:-}" [[ -z "$project" ]] && { echo "Usage: domains "; exit 1; } cat << EOF # Check domain and SSL status for: $project curl -s "$VERCEL_API/v9/projects/$project/domains" \\ ``` ```bash cmd_rollback() { local project="${1:-}"; local dep_id="${2:-}" [[ -z "$project" || -z "$dep_id" ]] && { echo "Usage: rollback "; exit 1; } cat << EOF # Rollback $project to deployment $dep_id curl -s -X POST "$VERCEL_API/v9/projects/$project/promote/$dep_id" \\ -H "Authorization: Bearer YOUR_TOKEN" \\ -H "Content-Type: application/json" ``` ```bash cmd_env() { local project="${1:-}"; local target="${2:-production}" [[ -z "$project" ]] && { echo "Usage: env- Remediation
View remediation