T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/research.sh:36
- Finding
- User-Controlled Keyword Enables Arbitrary Python Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/research.sh`, lines 36, 42, and 64 **Vulnerability Type**: Python code injection through unsafe interpolation **Risk Level**: High ### Vulnerable Code ```bash ENCODED_KW=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$KEYWORD'))") ``` The same vulnerable pattern is used when encoding expanded search terms: ```bash for prefix in "" "best " "cheap " "top "; do SEARCH_TERM="${prefix}${KEYWORD}" ENCODED=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${SEARCH_TERM}'))") ``` It is repeated during alphabet expansion: ```bash for letter in a b c d e f g h i j k l m n o p q r s t u v w x y z; do SEARCH_TERM="${KEYWORD} ${letter}" ENCODED=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${SEARCH_TERM}'))") ``` ### Technical Analysis The script embeds the user-controlled `KEYWORD` and derived `SEARCH_TERM` values directly inside source code passed to `python3 -c`. Shell quoting does not make this safe at the Python-language layer. A keyword containing a single quote and additional Python syntax can terminate the string passed to `urllib.parse.quote` and inject arbitrary Python statements. For example, a keyword shaped like the following can escape the intended Python string: ```text '); __import__("os").system("<attacker-command>"); # ``` After interpolation, the injected statement is parsed as part of the Python program. The unused `ENCODED_KW` assignment at line 36 is independently exploitable because command substitution executes the Python process even though its result is never subsequently used. The flaw is reached through the Skill's normal documented workflow, which instructs the Agent to pass a user-requested Amazon research keyword directly to this script. ### Attack Path 1. An attacker submits an Amazon research request containing a keyword crafted as Python syntax. 2. The Agent follows `SKILL.md` and invokes `scripts/research.sh` with tha ...[truncated 1053 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Never place user-controlled data inside source code supplied to `python3 -c`. Pass the value as a positional argument instead: ```bash ENCODED=$(python3 -c \ 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1]))' \ "$SEARCH_TERM") ``` Apply this pattern to every encoding operation. The assignment to `ENCODED_KW` should be removed because it is unused. Additional hardening should include: 1. Enable strict shell behavior: ```bash set -euo pipefail ``` 2. Treat the keyword strictly as data and quote every shell expansion. 3. Validate the marketplace and impose a reasonable maximum keyword length. 4. Consider performing URL encoding with `curl --data-urlencode` rather than dynamically invoking Python. 5. Add regression tests covering single quotes, double quotes, semicolons, newlines, command substitutions, and Python metacharacters. 6. Run the Skill in a sandbox with restricted filesystem access, minimal environment variables, and limited outbound networking. ]]>