T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:147- Finding
User-Controlled Values Embedded into Generated Bash and Python Code
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 147-166
Vulnerability Type: Command and code injection through unsafe script generation
Risk Level: HighVulnerable Code
bash TMPDIR=$(mktemp -d) # Expand ALL dimensions from the user's request: NIGHTS=(3 4 5) # e.g. "3-5 night trips" → 3, 4, 5 DESTINATIONS=("CDG" "PRG") # e.g. "Paris or Prague" → CDG, PRG DATES=("2026-05-01" "2026-05-02" "2026-05-03") # expand to all dates in range for DEST in "${DESTINATIONS[@]}"; do for N in "${NIGHTS[@]}"; do for DATE in "${DATES[@]}"; do RETURN=$(python3 -c "from datetime import datetime,timedelta; print((datetime.strptime('$DATE','%Y-%m-%d')+timedelta(days=$N)).strftime('%Y-%m-%d'))") curl -s -X POST "https://google-flights-live-api.p.rapidapi.com/api/google_flights/roundtrip/v1" \ -H "Content-Type: application/json" \ -H "x-rapidapi-host: google-flights-live-api.p.rapidapi.com" \ -H "x-rapidapi-key: $RAPIDAPI_KEY" \ -d "{\"departure_date\": \"$DATE\", \"return_date\": \"$RETURN\", \"from_airport\": \"TLV\", \"to_airport\": \"$DEST\", \"currency\": \"usd\"}" \ -o "$TMPDIR/${DEST}_${N}n_${DATE}.json" & done done doneTechnical Analysis
The Skill instructs the agent to generate and execute a shell script from dimensions derived from the user's request. The generated values are placed into several syntactic contexts without a documented validation or safe-serialization boundary:
DATEis interpolated directly into Python source passed topython3 -c.Nis interpolated as an unquoted Python expression intimedelta(days=$N).DATE,RETURN, andDESTare manually interpolated into JSON rather than encoded by a JSON serializer.DEST,N, andDATEare used to construct output filenames.- The generated
DATES,NIGHTS, andDESTINATIONSarray declarations are themselves execut ...[truncated 2196 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace generated shell code with a fixed, reviewed implementation whose structure cannot be changed by user input.
- Validate all dates against a strict
YYYY-MM-DDformat and confirm them through a date parser before execution. - Accept night counts only as bounded decimal integers and reject signs, expressions, whitespace, and metacharacters.
- Validate airport and airline codes with an allowlist such as
^[A-Z]{3}$after mapping city names to canonical IATA codes. - Pass dynamic values to Python through positional arguments or standard input rather than interpolating them into
python3 -csource. - Construct request bodies with a JSON serializer, for example
jq -n --arg, instead of manual quoting. - Use generated opaque identifiers for temporary filenames rather than incorporating user-controlled values.
- Use Bash argument arrays and quote every expansion. Do not generate Bash array declarations from raw user text.
- Add cleanup through
trap 'rm -rf -- "$TMPDIR"' EXITso temporary data is removed on errors and interruption. - Update the README to accurately disclose that the Skill executes local tools and generated request orchestration logic.