T09 · Insecure Skill Coding Practices
Error
- Location
- metadata.json:11
- Finding
- Command Injection Through Unquoted Tool Parameters## Vulnerability Details **File Location**: `metadata.json`, lines 11–16 **Vulnerability Type**: Command injection through unsafe command-template interpolation **Risk Level**: High ### Vulnerable Code ```json "command": "python zodiac_api.py zone {{sign}}" }, { "name": "get_pairing_details", "description": "Fetch in-depth destiny-style romantic compatibility report, score, and relationship guide for two 48 Zodiac signs. Parameters 'sign1' and 'sign2' accept either 48-Zodiac IDs or birthdate strings (e.g., '05-09', '5/9'). The API resolves them automatically.", "command": "python zodiac_api.py pairing {{sign1}} {{sign2}}" ``` ### Technical Analysis The tool definitions directly interpolate the user-controlled `sign`, `sign1`, and `sign2` parameters into command strings without validation, shell escaping, or an argument-array execution mechanism. If the Skill framework executes these templates through a command shell, shell metacharacters embedded in a parameter can alter the intended command structure. For example, an attacker could supply a value containing a command separator such as `;`, causing the shell to execute an additional command rather than treating the entire value as a zodiac identifier. The URL encoding in `zodiac_api.py` does not mitigate this issue. Shell parsing occurs before Python receives the arguments, whereas URL encoding is only applied after the Python process starts. ### Attack Path 1. An attacker supplies a crafted zodiac parameter containing shell syntax through `sign`, `sign1`, or `sign2`. 2. The Skill framework substitutes the value directly into the corresponding `command` template. 3. If the framework invokes the resulting string through a shell, the shell interprets the injected metacharacters. 4. The intended Python command runs, and the injected command is executed separately with the privileges of the Agent or Skill runner. 5. The injected command may access local file ...[truncated 1116 chars]
- Remediation
- ## Remediation Suggestions 1. Replace string-based command execution with a structured argument-array interface that does not invoke a shell, for example: ```json { "executable": "python", "args": ["zodiac_api.py", "zone", "{{sign}}"] } ``` Apply the equivalent structure to the pairing command. 2. Validate every parameter before execution. Permit only explicitly supported formats, such as: - Zone IDs: a tightly constrained allowlist or pattern such as lowercase zodiac names followed by an expected zone number. - Dates: numeric month-day formats with valid calendar ranges. 3. Reject whitespace, control characters, command separators, redirection operators, substitutions, and other unexpected characters. 4. If the framework only supports command strings, use its documented native argument-escaping mechanism. Simple manual quoting is not sufficient across all shells and platforms. 5. Add tests containing shell metacharacters and malformed values to confirm that inputs are either rejected or passed as one literal argument. 6. Run the Skill under a restricted account with minimal filesystem access, a sanitized environment, and outbound network access limited to the declared zodiac API endpoint.