T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:20- Finding
Shell Command Injection Through Untrusted tmux Workflow Placeholders
- Content
View full analysis
" | grep -i claude ``` ```sh tmux send-keys -t -l -- "" sleep 0.1 tmux send-keys -t Enter ``` ### Technical Analysis The documented workflow places the user-controlled `` directly inside a double-quoted shell argument. Double quotes do not prevent shell command substitution through constructs such as `$(...)` or backticks. Consequently, a prompt containing shell substitution syntax may be executed by the local shell before `tmux` receives the prompt. The `tmux send-keys -l` option only tells tmux to treat the supplied keys literally. It does not protect the command from prior evaluation by the shell. The workflow also interpolates `` into a double-quoted `grep` expression and uses the derived `` as an unquoted shell argument. A crafted value containing quotes, command substitutions, shell separators, or option-like content could change the meaning of the generated command. Independently of command execution, treating the session name as a regular expression can cause incorrect pane selection. The vulnerability arises when an agent follows the skill by constructing and executing the displayed commands as shell text rather than passing values as opaque process arguments. ### Attack Path 1. An attacker asks the agent to send a prompt containing shell command-substitution syntax to a Claude tmux pane, or supplies a malicious session or target value. 2. The agent substitutes the attacker-controlled value into the command template from `SKILL.md`. 3. The resulting command is submitted to a shell. 4. The shell evaluates command substitutions or injected ...[truncated 1434 chars]- Remediation
View remediation