T09 · Insecure Skill Coding Practices
Error
- Location
index.js:15- Finding
Unrestricted Shell Command Execution Through WhatsApp Input
- Content
View full analysis
{ try { const output = execSync(command, { encoding: "utf8" }); return output; } catch (err) { return `Error running command: ${err.message}`; } }, ``` `triggers.json:11-18`: ```json { "pattern": "(?i).*run command (.*)", "description": "Run any command in the workspace", "run": "run_command", "arguments": { "command": "$1" }, "channels": ["whatsapp"] }, ``` ### Technical Analysis The WhatsApp trigger captures arbitrary text with `(.*)` and assigns it directly to the `command` argument. The `run_command` implementation then passes that untrusted value to `child_process.execSync`. `execSync` executes through a system shell. Consequently, the input may contain executable names, arguments, pipelines, redirections, command substitutions, and command-separator metacharacters. There is no command allowlist, argument validation, sender authorization, confirmation step, fixed working directory, privilege reduction, sandbox, timeout, or output limit. Although the trigger describes commands as operating “in the workspace,” the implementation does not set a workspace-bound working directory or otherwise restrict command effects to that workspace. ### Attack Path 1. An attacker able to send a message through the configured WhatsApp channel submits text matching `run command (.*)`. 2. The trigger stores all text following `run command` in the `$1` capture. 3. The captured text is supplied unchanged to `run_command`. 4. `execSync` interprets the text using the host operating system’s shell. 5. The command runs with the privileges and environment of the Agent process. 6. The at ...[truncated 627 chars]- Remediation
View remediation