T09 · Insecure Skill Coding Practices
- Location
scripts/draw_at_sunrise.sh:8- Finding
Unvalidated Plaintext Network Response Used in Bash Arithmetic
- Content
View full analysis
Vulnerability Details
File Location:
scripts/draw_at_sunrise.sh, lines 8-26
Vulnerability Type: Command injection through untrusted arithmetic input and insecure plaintext transport
Risk Level: Mediumbash # Retrieve the Shanghai sunrise time SUNRISE=$(curl -s "wttr.in/Shanghai?format=%S" 2>/dev/null) if [ -z "$SUNRISE" ]; then echo "Failed to retrieve sunrise time; using default 6:06" SUNRISE="06:06:04" fi # Extract hour and minute HOUR=$(echo "$SUNRISE" | cut -d: -f1) MIN=$(echo "$SUNRISE" | cut -d: -f2) echo "Today's Shanghai sunrise: $HOUR:$MIN" # Calculate waiting time CURRENT_HOUR=$(date +%H) CURRENT_MIN=$(date +%M) # Convert to total minutes CURRENT_TOTAL=$((10#$CURRENT_HOUR * 60 + 10#$CURRENT_MIN)) SUNRISE_TOTAL=$((10#$HOUR * 60 + 10#$MIN))Technical Analysis
The script retrieves data from
wttr.inwithout explicitly using HTTPS. Curl therefore interprets the endpoint as plaintext HTTP. An attacker capable of intercepting the network connection, or an attacker controlling the remote endpoint, can modify the sunrise response.The response is split into
HOURandMINfields withcut, but neither field is validated as a decimal value within the permitted time ranges. Both values are subsequently embedded in a Bash arithmetic expression.Bash arithmetic evaluation is not equivalent to strict integer parsing. Arithmetic expressions support variables, operators, and recursively evaluated expression constructs. Allowing attacker-controlled text to enter an arithmetic context can therefore cause unintended expression evaluation and, with an appropriately crafted Bash expression, potentially trigger command execution. At minimum, malformed input can cause arithmetic errors and terminate or disrupt the script.
The fallback only handles an empty response. It does not protect against nonempty malicious, malformed, redirected, or unexpected server responses.
...[truncated 1493 chars]
- Remediation
View remediation
Remediation Suggestions
-
Require encrypted transport and fail safely:
bash SUNRISE=$(curl --fail --silent --show-error \ --max-time 10 \ "https://wttr.in/Shanghai?format=%S") || { SUNRISE="06:06:04" } -
Validate the complete response before extracting or evaluating any fields:
bash if [[ "$SUNRISE" =~ ^([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9])$ ]]; then HOUR="${BASH_REMATCH[1]}" MIN="${BASH_REMATCH[2]}" else HOUR=6 MIN=6 fi -
Normalize validated values using strict decimal conversion before arithmetic. Never place arbitrary remote text directly into a Bash arithmetic expression.
-
Set defensive shell options such as
set -euo pipefail, while ensuring network and validation failures are handled through an explicit safe fallback. -
Consider replacing the shell parsing logic with a language that offers strict integer conversion and range checking.
-
Document the external network request and the optional sunrise helper in
SKILL.mdso operators can assess the privacy and trust implications before executing it.
-