T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:79
- Finding
- Shell Command Injection Through Unquoted File Path Placeholders<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:79-87` **Vulnerability Type**: Unquoted shell argument injection **Risk Level**: High ### Vulnerable Code ```bash # Python — syntax check python -m py_compile {file} # TypeScript — type check (suppress non-critical output) npx tsc --noEmit {file} 2>/dev/null # Run specific test if applicable python -m pytest {test_file} -x -q 2>/dev/null ``` ### Technical Analysis The Skill instructs the agent to interpolate `{file}` and `{test_file}` directly into shell command strings without argument-safe execution, path validation, or shell quoting. If either value contains shell metacharacters, the shell can interpret part of the filename as a separate command, redirection, pipeline, or command substitution. This affects all three documented verification commands. Merely surrounding a value with ordinary quotes may also be insufficient if the quoting implementation does not safely handle embedded quote characters. The robust approach is to invoke the executable with an argument array and without a shell. ### Attack Path 1. An attacker creates a repository file whose path contains shell syntax, or persuades the user to identify such a path as the target or test file. 2. The Skill reads or edits that file and reaches the mandatory verification phase. 3. The agent replaces `{file}` or `{test_file}` with the attacker-influenced path. 4. The resulting string is passed to a shell. 5. The shell interprets metacharacters in the path and executes the injected command in addition to, or instead of, the intended compiler or test command. For example, a malicious path containing a command separator could transform the verification operation into multiple shell commands if interpolated verbatim. ### Impact Assessment Successful exploitation can execute arbitrary local commands with the same operating-system identity and permissions as the agent process. The accessible scope can include repository contents, fil ...[truncated 442 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not construct verification commands through string interpolation. - Invoke executables directly with argument arrays, such as `["python", "-m", "py_compile", file]`, with shell processing disabled. - Apply the same argument-safe method to TypeScript and test-runner commands. - Validate that target paths resolve within the intended repository root. - Reject paths containing NUL bytes or paths that escape the repository through traversal or symbolic links. - If the available tool API only accepts shell strings, use a platform-appropriate, well-tested shell-escaping routine rather than manual quoting. - Add test cases covering spaces, quotes, command separators, command substitutions, leading hyphens, and newline characters in filenames. - Where supported, place `--` before positional paths to prevent filenames beginning with `-` from being interpreted as options. ]]>