T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/speak.sh:33- Finding
Unvalidated Command-Line Options Permit JSON Request-Body Injection
- Content
View full analysis
&2 usage ;; esac done if [[ "${OPENAI_API_KEY:-}" == "" ]]; then echo "Missing OPENAI_API_KEY" >&2 exit 1 fi # Build JSON payload json=$(cat <- Remediation
View remediation
&2; exit 2 ;; esac case "$model" in tts-1|tts-1-hd) ;; *) echo "Invalid model" >&2; exit 2 ;; esac case "$format" in mp3|opus|aac|flac|wav|pcm) ;; *) echo "Invalid format" >&2; exit 2 ;; esac if ! [[ "$speed" =~ ^([0-3]([.][0-9]+)?|4([.]0+)?)$ ]] || ! awk -v value="$speed" 'BEGIN { exit !(value >= 0.25 && value <= 4.0) }' then echo "Invalid speed" >&2 exit 2 fi json=$(jq -n \ --arg model "$model" \ --arg input "$text" \ --arg voice "$voice" \ --arg format "$format" \ --argjson speed "$speed" \ '{ model: $model, input: $input, voice: $voice, response_format: $format, speed: $speed }') ``` 4. Add automated tests covering quotes, commas, braces, duplicate-property injection attempts, missing option values, non-numeric speeds, and out-of-range speeds. 5. Declare `jq` as a required binary in the skill metadata because the script depends on it for payload construction. ]]>