T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:122
- Finding
- Command Injection Through Unsanitized File Arguments<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:122-129` - `SKILL.md:785` - `AGENTS.md:91-97` - `references/review-actions.md:124-145` **Vulnerability Type**: Shell command injection through unquoted, unvalidated filename interpolation **Risk Level**: High ### Vulnerable Code From `SKILL.md:122-129`: ```bash # Adapt TEXINPUTS/BIBINPUTS to your project's preamble/bib locations xelatex -interaction=nonstopmode FILE.tex bibtex FILE xelatex -interaction=nonstopmode FILE.tex xelatex -interaction=nonstopmode FILE.tex ``` From `SKILL.md:785`: ```bash xelatex -interaction=nonstopmode FILE.tex ``` From `AGENTS.md:91-97`: ```bash xelatex -interaction=nonstopmode FILE.tex bibtex FILE xelatex -interaction=nonstopmode FILE.tex xelatex -interaction=nonstopmode FILE.tex ``` From `references/review-actions.md:124-145`: ```bash pdfinfo FILE.pdf | grep "Pages:" ``` ```bash pdfinfo FILE.pdf | grep "Page size:" ``` ```bash grep -c "Overfull \\\\hbox" FILE.log grep -c "Undefined control sequence" FILE.log grep -c "Citation.*undefined" FILE.log grep -c "multiply defined" FILE.log ``` ### Technical Analysis The `compile`, `visual-check`, and `validate` workflows place the user-provided `FILE` argument directly into shell command templates. The instructions do not require: - Validation that the path belongs to the intended workspace. - Rejection of shell metacharacters. - Shell-safe argument quoting. - Rejection of leading option characters. - Invocation through a structured argument array rather than a command string. If an agent implements these templates by textual substitution into a shell command, shell metacharacters embedded in the supplied argument can be interpreted as command syntax rather than as part of a filename. Quoting only selected suffixes would not be sufficient if the underlying filename remains concatenated into a shell expression. The issue affects several independently documented execution paths, including LaTeX compilation, PDF ...[truncated 1608 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat action arguments as untrusted data and resolve them through trusted file-selection or filesystem APIs before command execution. 2. Canonicalize the requested path and verify that it remains inside the intended project workspace. 3. Require the expected extension for each action, such as `.tex`, `.pdf`, or `.log`, rather than constructing paths from arbitrary shell text. 4. Reject control characters, shell metacharacters, and unexpected leading option characters. 5. Invoke tools through structured argument arrays without a shell whenever the runtime supports it. For example, pass `["xelatex", "-interaction=nonstopmode", file]` directly to the process API. 6. If a shell is unavoidable, place the complete variable inside robust quotes and use an option terminator where supported: ```bash xelatex -interaction=nonstopmode -- "$tex_file" bibtex -- "$bib_base" pdfinfo -- "$pdf_file" grep -c -- 'Undefined control sequence' "$log_file" ``` 7. Do not concatenate extensions after an unquoted variable. Construct and validate the complete path before invoking the command. 8. Use a dedicated temporary build directory with restricted permissions and prevent output paths from escaping it. 9. Document that agents must not substitute raw user input into the shown command templates. ]]>