T09 · Insecure Skill Coding Practices
Error
- Location
index.ts:6- Finding
Shell Command Injection Through User-Controlled Tool Arguments
- Content
View full analysis
callBaoziMCP('get_quote', { market: args.marketId }) } ``` ### Technical Analysis The application constructs a shell command by interpolating `JSON.stringify(args)` into a single-quoted shell argument and executes it using `child_process.exec()`. JSON serialization is not shell escaping. In particular, JSON strings may contain apostrophes because apostrophes have no special significance in JSON. An apostrophe supplied inside `marketId` or another tool argument terminates the surrounding shell single-quoted value. Subsequent shell metacharacters are then interpreted by the shell. The tool schemas only require values such as `marketId` to be strings; they do not enforce an expected identifier format or reject shell metacharacters. The same unsafe function is used for every tool, so all handlers that forward caller-controlled strings are potentially affected. The replacement implementation embedded in `SKILL.md` reproduces the same vulnerable pattern and expands the number of exposed tools. ### Attack Path 1. An attacker or untrusted prompt causes the A ...[truncated 1443 chars]- Remediation
View remediation