T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:94- Finding
Shell Command Injection Through User-Controlled MCP Arguments
- Content
View full analysis
.<工具名> <参数名>:"<参数值>" --output json ``` Examples demonstrating direct argument interpolation: ```bash mcporter call fund-diagnosis.fundIntro fundObject:"001048" --output json mcporter call fund-diagnosis.fundStagePerformance fundObject:"富国新兴产业" --output json mcporter call fund-investments.conditionSelectFund condition:"医药板块基金" --output json mcporter call fund-investments.buyerInvestmentAdvisor scene:"富国新兴产业股票型证券投资基金" --output json mcporter call public-opinion-explanation.queryPublicOpinionNews keyWords:"降息" --output json mcporter call ai-search-all.all_search query:"富国新兴产业基金" --output json ``` ### Technical Analysis The Skill instructs the agent to build shell commands by placing fund names, search keywords, conditions, and other potentially user-controlled values inside a Bash command string. Double quotation marks alone do not provide safe shell argument handling. Shell constructs such as command substitution remain active inside double-quoted strings. For example, if a user-supplied search value containing `$(malicious-command)` is inserted into the documented template, Bash may execute the substituted command before invoking `mcporter`. Embedded quotation marks can also terminate the intended argument and introduce shell operators. The issue arises because structured tool parameters are converted into executable shell syntax without a defined validation, escaping, or safe argument-passing mechanism. ### Attack Path 1. An attacker submits a crafted fund name, keyword, or search condition containing shell syntax. 2. The agent follows the documented command template and interpolates the value into a Bash command. 3. Bash parses command substitutions, quotation marks, redirections, or command separators in the attacker-controlled value. 4. The injected command ...[truncated 518 chars]- Remediation
View remediation