T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:87- Finding
Shell Command Injection Through Unsafe Prompt Interpolation
- Content
View full analysis
"}' \ --output-dir ``` The same construction appears in the wide-format example: ```bash runcomfy run blackforestlabs/flux-2-klein/9b/text-to-image \ --input '{"prompt": "", "width": 1536, "height": 864}' \ --output-dir ``` The Skill also makes the following security claim: ```markdown - **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content. ``` ### Technical Analysis The examples place an untrusted user prompt inside a single-quoted shell argument. Although the RunComfy CLI may treat a safely received JSON argument as data, the shell processes quoting and metacharacters before the CLI starts. If an implementation replaces `` directly with user-controlled text, a single quote in that text terminates the quoted argument. The attacker can then introduce shell operators and commands. Consequently, the assertion that there is no shell-injection surface is only true if JSON is serialized independently and passed to the process without unsafe textual shell interpolation. For example, a prompt containing a payload shaped like the following could escape the intended argument when inserted verbatim: ```text '; attacker_command; # ``` This is an exploitable documentation-level coding flaw because the Skill explicitly instructs an Agent to construct commands from user input using this pattern. ### Attack Path 1. An attacker supplies an image-generation prompt containing a single quote followed by shell sy ...[truncated 1061 chars]- Remediation
View remediation
` in shell command strings. 2. Validate and constrain the output directory independently. 3. Update the security statement to explain that safety depends on serialization and argument-safe process invocation. 4. Add tests using prompts containing single quotes, double quotes, command substitutions, newlines, and shell separators. ]]>