T09 · Insecure Skill Coding Practices
- Location
SKILL.md:34- Finding
Potential Shell Command Injection Through an Unsanitized Monitor Objective
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 34-41; the vulnerable objective placeholder appears on line 36
Vulnerability Type: Shell command injection through user-controlled command arguments
Risk Level: MediumVulnerable Code
bash parallel-cli monitor create "<objective>" [options] parallel-cli monitor list --json parallel-cli monitor get mon_xxx --json parallel-cli monitor update mon_xxx [options] --json parallel-cli monitor delete mon_xxx parallel-cli monitor events mon_xxx --json parallel-cli monitor simulate mon_xxx --jsonTechnical Analysis
The skill instructs the agent to insert a natural-language monitoring objective into a shell command. The objective originates from the user's request, but the documentation does not require structured argument execution, validation, or shell-safe escaping.
Enclosing the objective in double quotes does not neutralize every shell construct. In common POSIX-compatible shells, command substitutions such as
$(command)and backtick substitutions are still evaluated inside double-quoted strings. If an agent performs direct textual substitution and submits the resulting command to a shell, a malicious objective could cause local commands to run beforeparallel-clireceives its arguments.For example, an objective containing
$(id)would be evaluated by the shell if directly interpolated into the documented template. The resulting command output would then become part of the argument passed toparallel-cli.Attack Path
- An attacker supplies a monitoring request whose objective includes shell syntax, such as command substitution, backticks, a newline, or other control characters.
- The agent selects this skill and copies the objective into the documented
parallel-cli monitor createtemplate. - The agent invokes the assembled command through a shell rather than passing a structured argument array directly to the proc ...[truncated 863 chars]
- Remediation
View remediation
Remediation Suggestions
- Require invocation through a process API that accepts an argument array, for example passing
["monitor", "create", objective, "--json"]directly toparallel-cliwithout a shell. - Explicitly prohibit constructing commands by concatenating or textually substituting user-controlled objectives into shell command strings.
- If shell execution is unavoidable, apply robust platform-specific argument escaping and reject command substitutions, backticks, shell control operators, redirections, embedded newlines, and null bytes.
- Add a security note beside the CLI examples explaining that placeholders represent separate process arguments rather than raw shell fragments.
- Validate cadence and other enumerated options against an allowlist. Validate webhook values as URLs and pass them as separate arguments.
- Add tests covering malicious objectives containing
$(...), backticks, semicolons, redirections, quotes, backslashes, and newline characters.
- Require invocation through a process API that accepts an argument array, for example passing