T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:61
- Finding
- Shell Command Injection Through Untrusted Short URL<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:61-64` **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash echo -n "<short-url>" | xclip -selection clipboard 2>/dev/null || echo -n "<short-url>" | pbcopy 2>/dev/null || true ``` ### Technical Analysis The workflow instructs the Agent to interpolate the short URL returned by the Linkfuse API directly into a shell command. Double quotes do not prevent shell evaluation of command substitutions such as `$(command)` or backticks. An embedded double quote can also terminate the quoted value and introduce additional shell syntax. The short URL is external data received from `https://app.linkfuse.net/api/v1/links`. Although this is a fixed HTTPS endpoint and there is no evidence that it currently returns malicious values, API responses must still be treated as untrusted. A compromised service, compromised account, malicious upstream value, or unexpected API response could supply shell metacharacters. If the Agent follows the documented clipboard workflow by constructing and executing this command, the shell can evaluate the injected payload. The network request itself is necessary for the declared link-creation functionality: `scripts/create-link.js` sends the user-provided URL and bearer token only to the documented Linkfuse HTTPS API. The token is not logged. The vulnerability is in the optional clipboard command, not in the required API request. ### Attack Path 1. An attacker gains the ability to influence the API response, such as through service compromise or an unexpected reflected value. 2. The API returns a crafted `url` value containing shell syntax, for example a command substitution or a quote followed by shell operators. 3. `scripts/create-link.js` emits that value as the `url` field in its JSON output. 4. The Agent substitutes the returned value for `<short-url>` in the documented clipboard command. 5. The Agent executes the resulting com ...[truncated 824 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not interpolate the API response into a shell command. - Use a process-spawning API that invokes `xclip` or `pbcopy` directly without a shell and supplies the URL through a dedicated stdin pipe. - If a shell is unavoidable, pass the value through an environment variable or positional argument rather than embedding it in command text, and use a correctly quoted fixed script. - Validate the API response before clipboard handling: - Require a string value. - Parse it with a URL parser. - Permit only `https:` URLs. - Optionally restrict the hostname to the documented Linkfuse short-link domain. - Reject control characters, newlines, and malformed URLs. - Keep clipboard copying optional and display the validated URL without automatically executing shell commands derived from it. - Validate the response schema in `scripts/create-link.js` before printing it, ensuring that `data.url` and `data.title` have the expected types and formats. ]]>