T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:24- Finding
Shell Command Injection Through Unsafe Prompt Interpolation
- Content
View full analysis
' \ --filename ".png" \ --resolution 2K ``` The editing workflow repeats the same unsafe interpolation pattern: ```bash uv run {nano-banana-pro-dir}/scripts/generate_image.py \ --prompt '' \ --filename "edited-output.png" \ -i "/path/to/original.png" \ --resolution 2K ``` ### Technical Analysis The Skill instructs the Agent to incorporate content derived from the user's image request into a JSON prompt and then insert that prompt directly into a single-quoted shell argument. Single quotes only protect the argument until another single quote is encountered. If user-controlled content contains an apostrophe followed by shell syntax, it can terminate the quoted argument and introduce an additional command. For example, malicious text conceptually shaped like the following could escape the prompt argument when copied into the generated JSON: ```text '; attacker-controlled-command; # ``` The exact payload depends on how the Agent constructs and submits the command, but the underlying issue is that data and shell syntax are combined in one command string without context-aware escaping. Although `SKILL.md` explicitly requires filename sanitization, it provides no equivalent protection for the more directly user-controlled `--prompt` value. The same concern applies to dynamically substituted generator, input-image, and output paths if they are interpolated into a shell command rather than supplied as separate process arguments. ### Attack Path 1. An attacker submits an image-generation or editing request containing a single quote and shell control operators. 2. The Agent incorporates the attacker-controlled ...[truncated 1558 chars]- Remediation
View remediation