T09 · Insecure Skill Coding Practices
Warning
Untrusted Stored Verification Commands Can Induce Arbitrary Command Execution
scripts/cmds/cmd_complete.sh:22` will natively print the Bash subshell checkpoint. **For security (RCE prevention), these checkpoints must be executed manually.**
```
`SKILL.md:72`:
```markdown
4. **Completion and Checkpoints**: Run `task complete `. If your task contains a Checkpoint Validation (a Bash subshell script), the engine will output the command for you to run manually. **You must repair the codebase until the tests pass before you can technically complete the task and self-terminate.**
```
`scripts/cmds/cmd_create.sh:50-51`:
```bash
local verify_val="NULL"
[ -n "$verify" ] && verify_val="'$(printf '%s' "$verify" | sed "s/'/''/g")'"
```
`scripts/cmds/cmd_edit.sh:58-65`:
```bash
if [ -n "$verify" ]; then
local safe_verify
safe_verify=$(printf '%s' "$verify" | sed "s/'/''/g")
[ -n "$updates" ] && updates="$updates, "
if [ "$verify" = "none" ] || [ "$verify" = "null" ] || [ "$verify" = "NULL" ]; then
updates="${updates}verification_cmd = NULL"
else
updates="${updates}verification_cmd = '$safe_verify'"
fi
fi
```
`scripts/cmds/cmd_complete.sh:22-27`:
```bash
local verify_cmd
verify_cmd=$(sql "SELECT verification_cmd FROM tasks WHERE id = $id;" 2>/dev/null) || true
if [ -n "$verify_cmd" ]; then
printf '\033[1;33mManual Checkpoint Required:\033[0m %s\n' "$verify_cmd"
printf '\033[1;34mNote:\033[0m Auto-execution disabled for security (RCE prevention).\n'
fi
```
### Technical Analysis
The task creation and editing commands accept arbitrary text through `--verify` and persist it as `verifica
...[truncated 2620 chars]