T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:93
- Finding
- Command Injection Through Unescaped User Query<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 93-97 **Vulnerability Type**: OS command injection **Risk Level**: High ### Vulnerable Code ```bash python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py \ --query "<用户问题原话>" \ --template-id <运行时的搭子 template_id> \ --output ~/cue-reports/$(date +%Y-%m-%d-%H%M)-domestic-regulation.md ``` The parameter description at line 102 further instructs the agent to use the user's original query without rewriting it: ```markdown | `--query` | 用户原话，不要改写 | ``` ### Technical Analysis The Skill directs the agent to insert the user's original, untrusted query into a double-quoted shell argument. Double quotes do not suppress shell command substitution. Constructs such as `$(command)` and backticks are evaluated by the shell before `research_run.py` starts. Consequently, a query containing shell substitution syntax can cause arbitrary commands to run under the account executing the Skill. Quoting the argument with ordinary double quotes does not adequately sanitize it. ### Attack Path 1. An attacker supplies a legal-research query containing a shell expression, such as a `$(...)` substitution. 2. The Skill instructs the agent to preserve the query verbatim. 3. The agent substitutes that query into the documented shell command. 4. The shell evaluates the embedded substitution before launching Python. 5. The attacker's command executes with the privileges of the agent's local operating-system account. 6. The command can read accessible files, alter user data, extract the Cue API key, or download and execute additional payloads. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the agent. The attacker could access all files and credentials available to that account, modify or delete user data, steal `~/.cue/config.json`, tamper with local tools, and potentially establish persistence where the account has sufficien ...[truncated 178 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not construct a shell command by textual interpolation of the user query. - Launch the runner through an argument-array API that does not invoke a shell. For example, use Python's `subprocess.run()` with `shell=False` and one list element per argument. - Alternatively, pass the query through standard input or a securely created input file. - Treat the template ID as untrusted as well and validate it against the expected identifier format. - If shell execution is unavoidable, apply a proven argument-escaping mechanism such as Python's `shlex.quote()` to every dynamic argument. Prefer avoiding the shell entirely. - Add adversarial tests covering command substitutions, backticks, quotation marks, newlines, semicolons, redirections, and shell metacharacters. - Replace the instruction to insert the query into a shell command with an implementation that keeps user data and executable command syntax structurally separate. ]]>