T09 · Insecure Skill Coding Practices
- Location
SKILL.md:192- Finding
Shell Command Injection Through Heredoc-Based TTS Input
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 192-199
Vulnerability Type: Shell command injection through unsafe heredoc construction
Risk Level: HighThe skill instructs the agent to embed generated, user-influenced script content directly into shell source:
bash uv run /home/clawdbot/clawdbot/skills/sag/scripts/tts.py \ -o /tmp/audio-gen-[timestamp]-[topic-slug].mp3 \ -m eleven_multilingual_v2 \ "$(cat <<'EOF' [formatted_script] EOF )"Technical Analysis
Using a quoted heredoc delimiter prevents parameter and command expansion inside the intended heredoc body, but it does not prevent untrusted content from terminating the heredoc. A generated script containing a line consisting exactly of
EOFcloses the heredoc prematurely.Any subsequent lines are parsed as shell syntax inside the command substitution. Because the script is generated from user-supplied topics and instructions, an attacker can request content containing a standalone delimiter followed by a shell command. The documentation provides no validation, delimiter randomization, or non-shell transport mechanism.
For example, an attacker-controlled script segment could conceptually take this form:
text Ordinary narration. EOF attacker-controlled-commandWhen inserted into the documented command template, the second line ends the heredoc and the third line is interpreted by the shell rather than passed to the TTS program.
Attack Path
- An attacker requests audio content and causes the generated script to include a line containing only
EOF. - The attacker places shell syntax on one or more following lines.
- The agent follows the documented long-script workflow and interpolates that content into the heredoc command.
- The shell treats the injected
EOFas the heredoc terminator. - The following attacker-controlled text executes as shell commands with the privileges of the ...[truncated 614 chars]
- An attacker requests audio content and causes the generated script to include a line containing only
- Remediation
View remediation
Remediation Suggestions
- Do not interpolate generated or user-controlled text into shell source.
- Invoke the TTS program through a process API that accepts an argument array rather than a shell command.
- Prefer sending the script through the child process's standard input.
- If the TTS program requires a file, create it with a secure temporary-file API, write the content through a file API, and pass the resulting path as a discrete argument.
- Do not rely solely on a fixed or quoted heredoc delimiter. Randomizing the delimiter reduces accidental collisions but is not an adequate replacement for avoiding shell interpretation.
- Apply execution timeouts and environment allowlisting. Pass only the environment variables required by the TTS process.
- Add regression tests containing standalone
EOFlines, command substitutions, quotes, newlines, and shell metacharacters to verify that all content is treated strictly as data.