T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:127- Finding
Unquoted Deployment Identifier Allows Kubernetes CLI Argument Injection
- Content
View full analysis
- Remediation
View remediation
&2 return 2 fi ``` 2. Quote every variable expansion passed to external commands: ```bash current_version=$(kubectl get deployment "$service_name" \ -o jsonpath='{.spec.template.spec.containers[0].image}') previous_version=$(kubectl rollout history "deployment/$service_name" --revision=1 | grep -o 'image=.*' | cut -d'=' -f2) kubectl rollout undo "deployment/$service_name" kubectl rollout status "deployment/$service_name" --timeout=300s ``` 3. Use `--` before positional resource names where the relevant `kubectl` subcommand supports it, preventing values beginning with a hyphen from being treated as options. 4. Validate `target_environment` separately and map it to an explicit, allowlisted Kubernetes context or namespace rather than incorporating arbitrary input into commands. 5. Run rollback automation under a dedicated Kubernetes service account with narrowly scoped RBAC permissions. Restrict it to the required namespace and deployment resources, and avoid cluster-wide rollback privileges. 6. Avoid accepting raw deployment names from untrusted webhook or user input. Resolve externally supplied identifiers through a server-side allowlist of approved applications and deployment names. 7. Add automated negative tests covering whitespace, leading hyphens, glob characters, multiple resource names, and malformed Kubernetes identifiers. ]]>