T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:42- Finding
Shell Command Injection Through Unvalidated Escrow Parameters
- Content
View full analysis
``` ```bash nla escrow:fulfill \ --escrow-uid \ --fulfillment "" \ --oracle ``` ```bash nla escrow:collect \ --escrow-uid \ --fulfillment-uid ``` ### Technical Analysis The instructions direct the agent to interpolate user-provided or externally obtained values into Bash commands. These values include the escrow UID, fulfillment UID, fulfillment text, and oracle address. The document does not require strict validation of Ethereum addresses and UIDs or mandate a shell-safe argument-passing mechanism. In particular, placing fulfillment text within double quotes does not neutralize shell command substitution such as `$(...)` or backtick syntax. Unquoted identifier and address placeholders can additionally expose shell metacharacter, argument-injection, and word-splitting risks. The `Bash(nla:*)` tool restriction does not necessarily eliminate this issue when the permitted command begins with `nla` but the shell performs substitutions before invoking it. The actual exploitability depends on how the host agent constructs and executes the documented command. ### Attack Path 1. An attacker supplies a malicious escrow identifier, fulfillment identifier, oracle address, or fulfillment string to the user or agent. 2. The agent substitutes that value directly into one of the documented Bash command templates. 3. Bash parses the resulting command and evaluates embedded substitutions or metacharacters before executing `nla`. 4. The injected command runs with the privileges and environment of the agent process. 5. The attacker may read accessible environment variables or files, alter local data, or interf ...[truncated 1117 chars]- Remediation
View remediation