T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:132- Finding
Shell Command Injection Through Unvalidated Task IDs and Download URLs
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 132-141
Vulnerability Type: Shell command injection and unsafe external resource handling
Risk Level: HighVulnerable Code
markdown 1. Obtain the download URL through MCP 2. Use `exec curl` to download it locally ```bash exec curl -L -o ~/Downloads/video_task_abc123.mp4 "VIDEO_DOWNLOAD_URL"- Confirm the file size
bash exec ls -lh ~/Downloads/video_task_abc123.mp4text ### Technical Analysis The documented workflow instructs the Agent to build and execute shell commands using a task identifier supplied by the user and a download URL returned by the MCP server. It does not require either value to be validated before interpolation. The destination path is not quoted. If an Agent replaces the example task identifier with user-controlled text, shell metacharacters such as command separators, redirection operators, or command substitutions can alter the command. Quoting the URL does not provide a reliable security boundary when the Agent constructs the complete command text before passing it to a shell. A malicious MCP response could insert shell syntax into the generated command or direct `curl` to an unintended resource. The command also uses `curl -L`, which automatically follows redirects without requiring validation of the final destination. There is no HTTPS requirement, hostname allowlist, protocol restriction, content-type validation, maximum file-size limit, or safe handling of a filename beginning with an option-like prefix. ### Attack Path 1. An attacker supplies a crafted task ID containing shell metacharacters, or compromises/spoofs the local MCP service and returns a malicious download URL. 2. The Agent follows the Skill instructions and substitutes the attacker-controlled value into the documented `exec curl` or `exec ls` command. 3. The resulting command string is passed to a shell. 4. The shell interprets ...[truncated 1096 chars]- Remediation
View remediation
Remediation Suggestions
- Replace shell-based downloading with a structured HTTP client or download tool that accepts the URL and destination as separate arguments without invoking a command shell.
- Validate task IDs against a strict allowlist, such as
^[A-Za-z0-9_-]{1,128}$, before using them in filenames. - Generate the local filename independently rather than deriving it directly from untrusted input.
- If process execution is unavoidable, use an argument-array API with shell interpretation disabled. Do not build a single command string.
- Require HTTPS and allowlist the expected video-content hostnames.
- Validate every redirect target and reject redirects to non-allowlisted hosts, loopback addresses, link-local addresses, private network ranges, and unsupported protocols.
- Apply download size, timeout, and content-type limits before saving the response.
- Save files into a dedicated directory using restrictive permissions and a securely generated filename. Prevent overwriting existing files unless the user explicitly approves it.
- Verify file metadata through filesystem APIs rather than invoking
ls. - If
curlmust be retained, invoke it without a shell, include an explicit--option terminator where applicable, restrict protocols, and validate the URL before execution.