T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:42
- Finding
- Shell Command Injection Through Unvalidated Escrow Parameters<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:22`, `SKILL.md:42-45`, and `SKILL.md:68-70` **Vulnerability Type**: Command injection through unsafe shell argument construction **Risk Level**: High ### Vulnerable Code ```bash nla escrow:status --escrow-uid <uid> ``` ```bash nla escrow:fulfill \ --escrow-uid <escrow_uid> \ --fulfillment "<fulfillment text>" \ --oracle <oracle_address> ``` ```bash nla escrow:collect \ --escrow-uid <escrow_uid> \ --fulfillment-uid <fulfillment_uid> ``` ### Technical Analysis The instructions direct the agent to interpolate user-provided or externally obtained values into Bash commands. These values include the escrow UID, fulfillment UID, fulfillment text, and oracle address. The document does not require strict validation of Ethereum addresses and UIDs or mandate a shell-safe argument-passing mechanism. In particular, placing fulfillment text within double quotes does not neutralize shell command substitution such as `$(...)` or backtick syntax. Unquoted identifier and address placeholders can additionally expose shell metacharacter, argument-injection, and word-splitting risks. The `Bash(nla:*)` tool restriction does not necessarily eliminate this issue when the permitted command begins with `nla` but the shell performs substitutions before invoking it. The actual exploitability depends on how the host agent constructs and executes the documented command. ### Attack Path 1. An attacker supplies a malicious escrow identifier, fulfillment identifier, oracle address, or fulfillment string to the user or agent. 2. The agent substitutes that value directly into one of the documented Bash command templates. 3. Bash parses the resulting command and evaluates embedded substitutions or metacharacters before executing `nla`. 4. The injected command runs with the privileges and environment of the agent process. 5. The attacker may read accessible environment variables or files, alter local data, or interf ...[truncated 1117 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate every blockchain identifier before use: - Ethereum addresses should match a strict 20-byte hexadecimal format such as `^0x[a-fA-F0-9]{40}$`. - Escrow and fulfillment UIDs should be validated against their exact documented byte length and encoding. - Reject whitespace, shell metacharacters, control characters, and unexpected option prefixes. 2. Do not assemble commands through string interpolation. Invoke the CLI using an argument array so each value is passed as one literal argument. For example: ```text ["nla", "escrow:fulfill", "--escrow-uid", validatedEscrowUid, "--fulfillment", fulfillmentText, "--oracle", validatedOracleAddress] ``` 3. If the execution environment only supports shell command strings, use a well-tested shell-escaping routine for every dynamic value. Do not rely solely on double quotes. 4. Add an explicit instruction that values displayed by escrow status output remain untrusted and must be validated before reuse. 5. Require transaction previews and explicit user confirmation before any command that commits a bond, spends gas, submits an on-chain fulfillment, or transfers tokens. 6. Run the CLI in a restricted environment with minimal filesystem access, a sanitized environment, and no unrelated credentials. ]]>