T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:98- Finding
Shell Command Injection Through an Untrusted Investigation Prompt
- Content
View full analysis
" --project --session /tmp/ ``` ### Technical Analysis The documented workflow places the user-supplied investigation prompt directly inside a shell command. Double quotes do not prevent shell evaluation of command substitutions such as `$(...)` or backticks. A prompt containing an unescaped double quote can also terminate the quoted argument and introduce shell operators or additional commands. If an agent implements this instruction by constructing a command string and passing it to a shell, attacker-controlled prompt content can become executable shell syntax. The instructions do not require an argument-array process API, shell escaping, validation, or rejection of control characters. ### Attack Path 1. An attacker submits a production investigation request containing shell syntax, such as a double quote followed by a command substitution or command separator. 2. The agent replaces the documented `` placeholder with the attacker-controlled text. 3. The resulting command string is executed through a shell. 4. The shell interprets the injected syntax rather than passing the entire prompt as one literal argument. 5. The injected command runs with the operating-system privileges and accessible environment of the agent process. Exploitation depends on the agent executing the example through a shell. A structured process API that passes each argument independently would prevent this attack path. ### Impact Assessment Successful exploitation could permit arbitrary command execution with the privileges of the process running the skill. An attacker could read or modify files accessible to that account, access environment variables or loc ...[truncated 456 chars]- Remediation
View remediation