T09 · Insecure Skill Coding Practices
Error
- Location
scripts/transcribe.py:18- Finding
Shell Command Injection Through Untrusted Arguments and External URLs
- Content
View full analysis
&1', timeout=90 ) ``` ```python rc, out, err = e(f'curl -L --max-time 120 -o "{path}" "{url}" 2>&1') ``` ```python rc, out, err = e( f'ffmpeg -i "{video_path}" -vn -acodec pcm_s16le -ar 16000 -ac 1 "{audio_path}" -y 2>&1 | tail -5', timeout=300 ) ``` ```python rc, out, err = e(f'coli asr --model sensevoice "{audio_path}" 2>&1', timeout=600) ``` ```python rc2, out2, err2 = e( f'uv run --with faster-whisper python3 -c "\n' 'from faster_whisper import WhisperModel\n' 'model = WhisperModel(\"small\", device=\"cpu\", compute_type=\"int8\")\n' 'segs, _ = model.transcribe(\"{audio_path}\", beam_size=5)\n' 'for s in segs: print(s.text, end=\"\", flush=True)\n' 'print()\n" 2>&1', timeout=600 ) ``` ### Technical Analysis The helper function executes every constructed command with `shell=True`. Several values interpolated into these commands are not trusted: - `douyin_url` comes directly from the required `--url` command-line argument. - Paths are derived from the user-controlled `--output-dir` argument. - `videoUrl` and `coverUrl` are extracted from traffic and DOM content produced by the external `hellotik.app` service. - `audio_path` is also embedded inside a Python source string passed through a shell. Surrounding values with double quotes is not an adequate shell-escaping mechanism. Shell command substitution remains active inside double quotes, and embedded quote or shell metacharacter sequenc ...[truncated 1677 chars]- Remediation
View remediation