T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:79- Finding
Shell Command Injection Through Unquoted File Path Placeholders
- Content
View full analysis
/dev/null # Run specific test if applicable python -m pytest {test_file} -x -q 2>/dev/null ``` ### Technical Analysis The Skill instructs the agent to interpolate `{file}` and `{test_file}` directly into shell command strings without argument-safe execution, path validation, or shell quoting. If either value contains shell metacharacters, the shell can interpret part of the filename as a separate command, redirection, pipeline, or command substitution. This affects all three documented verification commands. Merely surrounding a value with ordinary quotes may also be insufficient if the quoting implementation does not safely handle embedded quote characters. The robust approach is to invoke the executable with an argument array and without a shell. ### Attack Path 1. An attacker creates a repository file whose path contains shell syntax, or persuades the user to identify such a path as the target or test file. 2. The Skill reads or edits that file and reaches the mandatory verification phase. 3. The agent replaces `{file}` or `{test_file}` with the attacker-influenced path. 4. The resulting string is passed to a shell. 5. The shell interprets metacharacters in the path and executes the injected command in addition to, or instead of, the intended compiler or test command. For example, a malicious path containing a command separator could transform the verification operation into multiple shell commands if interpolated verbatim. ### Impact Assessment Successful exploitation can execute arbitrary local commands with the same operating-system identity and permissions as the agent process. The accessible scope can include repository contents, fil ...[truncated 442 chars]- Remediation
View remediation