T09 · Insecure Skill Coding Practices
Warning
- Location
- templates/AGENTS.md:73
- Finding
- Shell Command Injection Risk in Mandated Diary Append Operations## Vulnerability Details **File Location**: `templates/AGENTS.md:73` and `templates/HEARTBEAT.md:144` **Vulnerability Type**: Shell command injection through unsafe construction of diary append commands **Risk Level**: Medium ### Vulnerable Code Both templates mandate diary appends through the following operative shell command: ```bash echo [diary content] >> [diary file] ``` The instructions specifically require use of the `exec` tool with `echo >> file` rather than a structured file-writing operation. ### Technical Analysis Diary entries can contain content derived from user conversations, recommendations, place names, travel descriptions, and other externally influenced text. Placing such text directly into an `echo` command creates a shell interpretation boundary. If the Agent constructs the command without rigorous shell escaping, characters such as command substitutions, quotes, semicolons, pipes, or redirection operators can alter the intended command. For example, attacker-controlled text containing a command substitution could be executed by the shell instead of being written literally to the diary. This is an insecure instruction pattern even though the template does not contain a malicious payload itself. It directs downstream Agents to use a shell for a task that does not require shell interpretation. ### Attack Path 1. An attacker supplies text likely to be incorporated into a diary entry, such as a recommendation, location, or conversational statement. 2. The supplied text contains shell metacharacters or command-substitution syntax. 3. Following the template, the Agent embeds the text into an `exec` command using `echo ... >> memory/YYYY-MM-DD.md`. 4. If quoting is absent or incomplete, the shell interprets part of the diary content as syntax. 5. The injected command executes with the same operating-system privileges and filesystem access as the Agent runtime. Exploitation depends on the downstrea ...[truncated 666 chars]
- Remediation
- ## Remediation Suggestions - Replace the mandated `exec` and `echo` workflow with a structured append-file tool that does not invoke a shell. - Alternatively, add a small Python helper that accepts diary content as data and opens the target file in append mode: ```python with open(diary_path, "a", encoding="utf-8") as diary: diary.write(content + "\n") ``` - Validate that the diary path resolves beneath the intended memory directory. - If shell execution is unavoidable, pass content through a non-shell argument channel and use a fixed command with robust positional-argument handling. Do not concatenate content into a shell command. - Apply the same correction to `templates/HEARTBEAT.md:144`. - Add adversarial tests using quotes, command substitutions, semicolons, newlines, pipes, and redirection characters to confirm that all content is stored literally.