T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:27- Finding
Shell Command Injection Through User-Controlled SQL, Database Names, and File Paths
- Content
View full analysis
audit sql "" dbskiter --output-mode=ai --database= audit sql "" dbskiter --output-mode=ai --database= audit ddl "" dbskiter --output-mode=ai --database= audit file ``` The associated workflow directs the agent to extract user-provided SQL or DDL and place it directly into these command templates before execution. ### Technical Analysis The skill constructs command-line instructions by textually interpolating user-controlled values into shell command strings. The SQL and DDL arguments are enclosed in double quotes, but double quotes do not suppress shell command substitution through `$(...)` or backticks. A malicious value can therefore cause the shell to execute a nested operating-system command before `dbskiter` receives the argument. The `` database value and `` file value are not quoted at all. If these placeholders are populated from untrusted input, shell separators, redirections, substitutions, whitespace, or option-like values may alter the intended command. The same unsafe pattern appears in the optimization, index recommendation, cost estimation, and rewrite templates at lines 92–116. Exploitation depends on the agent or runtime executing the generated command through a shell. The skill explicitly instructs the agent to execute these textual command templates and does not require an argument-array API, input validation, path restrictions, or shell-safe handling. ### Attack Path 1. An attacker asks the agent to audit SQL or DDL containing shell substitution syntax, for example: ```sql SELECT '$(attacker-controlled-command)' ``` 2. The ski ...[truncated 1391 chars]- Remediation
View remediation