T09 · Insecure Skill Coding Practices
Error
- Location
scripts/video-intel.sh:62- Finding
Remote Video Title Can Cause Shell Command Injection
- Content
View full analysis
/dev/null || true # Find first non-empty caption file (prefer explicit lang, then any) SRT=$(find "$CAPDIR" \( -name "*.${LANG}.vtt" -o -name "*.${LANG}.srt" \) -size +0c | head -1) [[ -s "$SRT" ]] || SRT=$(find "$CAPDIR" -name "*.en.vtt" -o -name "*.en.srt" | xargs -I{} sh -c '[ -s "{}" ] && echo "{}"' | head -1) [[ -s "$SRT" ]] || SRT=$(find "$CAPDIR" \( -name "*.vtt" -o -name "*.srt" \) -size +0c | head -1) ``` ### Technical Analysis The output template incorporates `%(title)s`, meaning a remote video's title influences the name of the downloaded caption file. The resulting path is subsequently substituted by `xargs` into a command string passed to `sh -c`: ```bash sh -c '[ -s "{}" ] && echo "{}"' ``` Quoting the `{}` placeholder inside the command string does not safely encode the filename as shell data. If a generated filename contains quotation marks or shell metacharacters that survive `yt-dlp` filename processing, it can terminate the quoted expression and introduce additional shell syntax. The core flaw is interpreting an externally influenced filename as shell source code instead of passing it as a positional argument. The use of `sh -c` is unnecessary for checking whether a file is non-empty. ### Attack Path 1. An attacker publishes or controls a supported video whose title is crafted to contain shell syntax. 2. The attacker supplies the video's URL to a victim or induces the victim to request its transcript. 3. The `transcript` command invokes `yt-dlp`, using the remote title as part of th ...[truncated 1228 chars]- Remediation
View remediation