T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:162
- Finding
- User-Controlled Social Post Content Embedded in Executable Python and Shell Code## Vulnerability Details **File Location**: `SKILL.md`, lines 162–176 **Vulnerability Type**: Command and Python code injection **Risk Level**: High The documented posting workflow instructs an agent to replace placeholder content directly inside a double-quoted `python -c` shell command: ```bash source venv/bin/activate && python -c " from social_posting import SocialPostingClient from dotenv import load_dotenv load_dotenv() client = SocialPostingClient() result = client.post( content='''Your content here''', platforms=['platform1', 'platform2'], media_urls=['https://example.com/image.jpg'] # Optional ) print(f'Success: {result.success}') print(f'Provider: {result.provider}') print(f'Post ID: {result.post_id}') " ``` ### Technical Analysis The workflow constructs executable source code by interpolating social-media content into a Python triple-quoted string. An attacker-controlled post containing `'''` can terminate that string and append arbitrary Python statements. The Python program is also enclosed in a double-quoted shell argument. If user-controlled content is substituted before the shell parses the command, shell constructs such as command substitutions can be evaluated independently of the Python string boundary. Escaping content for only Python or only the shell would therefore be insufficient. The vulnerable behavior occurs when an agent follows the documented instruction by replacing `Your content here` with untrusted text and executes the resulting command. Although the file contains documentation rather than an implementation, it presents this unsafe construction as the operational workflow. ### Attack Path 1. An attacker submits a request to publish specially crafted social-media content. 2. The agent follows the skill workflow and inserts that content in place of `Your content here`. 3. The crafted content terminates the Python triple-quoted literal or introduce ...[truncated 1304 chars]
- Remediation
- ## Remediation Suggestions - Do not construct Python source code or shell commands by inserting post content into `python -c`. - Provide a fixed, reviewed Python script whose code is never generated from user input. - Transfer post content through standard input, a structured JSON file, or a separately supplied process argument. - Invoke the fixed script with an argument array and without a shell, such as through `subprocess.run([...], shell=False)`. - Parse structured input with a JSON library and pass the resulting string directly to `client.post`. - Validate platform names against an explicit allowlist and validate media URLs before posting. - Require a preview and explicit user confirmation before performing the externally visible posting action. - Run the posting client with least privilege and restrict access to `.env` and provider credentials. - Avoid printing credentials or including them in command-line arguments, logs, error messages, or generated source. - Add tests containing triple quotes, quotation marks, backticks, dollar-sign substitutions, newlines, and other metacharacters to verify that all content remains inert data.