T09 · Insecure Skill Coding Practices
- Location
SKILL.md:19- Finding
Arbitrary Shell Command Execution Through Unsafe Credential Initialization
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 19-21
Vulnerability Type: Shell command injection through unsafe use ofeval
Risk Level: HighVulnerable Code
bash Alternatively, put credentials in a JSON file and source them: ```bash eval $(jq -r '"export NEYNAR_API_KEY=\(.apiKey)\nexport NEYNAR_SIGNER_UUID=\(.signerUuid)"' /path/to/neynar.json)Technical Analysis
The documented credential-loading command converts values from a JSON file into shell source code and executes the result with
eval. The extractedapiKeyandsignerUuidvalues are interpolated without shell-safe quoting.Consequently, these fields are treated as executable shell syntax rather than strictly as data. Shell metacharacters, command substitutions, redirections, or command separators placed in either JSON value can alter the generated command and execute arbitrary local commands.
For example, a malicious credential value containing a command separator can cause the generated output to include an additional command when evaluated. The vulnerability does not require a defect in
jq; it results from passing attacker-influenced output to the shell parser througheval.Attack Path
- An attacker creates or modifies the credential JSON file used during setup.
- The attacker places shell syntax in the
apiKeyorsignerUuidfield. - A user follows the setup instructions and executes the documented
eval $(jq ...)command. jqemits anexportstatement containing the malicious value.evalreparses the emitted text as shell code.- The injected command executes with the privileges of the user running the setup command.
This path is exploitable when an attacker can influence the credential file, its source, or its contents.
Impact Assessment
Successful exploitation provides arbitrary command execution under the current user's account. The attacker could read or modify files available to that user, steal environment va ...[truncated 232 chars]
- Remediation
View remediation
Remediation Suggestions
Remove
evaland assign each parsed value directly so that it is never reparsed as shell syntax:bash NEYNAR_API_KEY=$(jq -er '.apiKey' /path/to/neynar.json) NEYNAR_SIGNER_UUID=$(jq -er '.signerUuid' /path/to/neynar.json) export NEYNAR_API_KEY NEYNAR_SIGNER_UUIDAdditionally:
- Require the credential file to be owned by the current user and protected with restrictive permissions such as
0600. - Validate that both properties are strings and conform to the expected API-key and UUID formats.
- Reject missing, null, multiline, or malformed values.
- Avoid recommending
sourcefor files containing externally supplied content. - Add a regression test containing shell metacharacters in JSON values and verify that no command is executed.
- Require the credential file to be owned by the current user and protected with restrictive permissions such as