T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:58- Finding
Command Injection Through Untrusted URL Interpolation
- Content
View full analysis
" | python3 -c " import sys, re html = sys.stdin.read() # Strip tags, get text text = re.sub('<[^>]+>', ' ', html) text = re.sub(r'\s+', ' ', text).strip() print(text[:5000]) " ``` ### Technical Analysis The documented workflow instructs the Agent to replace `` with URLs obtained from web searches and execute the resulting command through a shell. Although the placeholder is enclosed in double quotes, shell double quotes still permit command substitution through `$(...)` and backticks. Consequently, a malicious URL containing shell syntax can cause local commands to run before `curl` is invoked. The downloaded response body is not itself passed to a shell or Python evaluator—the fixed Python program only reads it as text—so this is not direct remote payload retrieval and execution. The vulnerability instead arises from unsafe construction of the `curl` command. The command also follows redirects with `-L` without defining destination, protocol, response-size, or timeout restrictions. This can expose internal or link-local HTTP services if an attacker controls the initial URL or a redirect destination. However, the confirmed code-execution issue is the shell interpolation of the URL. ### Attack Path 1. An attacker submits a research request containing a crafted URL or publishes a search result whose URL contains shell command-substitution syntax. 2. The Agent selects that URL while following the deep-read workflow. 3. The Agent replaces `` with the attacker-controlled value and executes the documented command using a shell. 4. The shell evaluates command substitutions inside the double-quoted URL before starting `curl`. 5. The injected command executes with the same operating-system identity and permissions as the Agent. F ...[truncated 1214 chars]- Remediation
View remediation