T09 · Insecure Skill Coding Practices
- Location
SKILL.md:162- Finding
User-Controlled Social Post Content Embedded in Executable Python and Shell Code
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 162–176
Vulnerability Type: Command and Python code injection
Risk Level: HighThe documented posting workflow instructs an agent to replace placeholder content directly inside a double-quoted
python -cshell command:bash source venv/bin/activate && python -c " from social_posting import SocialPostingClient from dotenv import load_dotenv load_dotenv() client = SocialPostingClient() result = client.post( content='''Your content here''', platforms=['platform1', 'platform2'], media_urls=['https://example.com/image.jpg'] # Optional ) print(f'Success: {result.success}') print(f'Provider: {result.provider}') print(f'Post ID: {result.post_id}') "Technical Analysis
The workflow constructs executable source code by interpolating social-media content into a Python triple-quoted string. An attacker-controlled post containing
'''can terminate that string and append arbitrary Python statements.The Python program is also enclosed in a double-quoted shell argument. If user-controlled content is substituted before the shell parses the command, shell constructs such as command substitutions can be evaluated independently of the Python string boundary. Escaping content for only Python or only the shell would therefore be insufficient.
The vulnerable behavior occurs when an agent follows the documented instruction by replacing
Your content herewith untrusted text and executes the resulting command. Although the file contains documentation rather than an implementation, it presents this unsafe construction as the operational workflow.Attack Path
- An attacker submits a request to publish specially crafted social-media content.
- The agent follows the skill workflow and inserts that content in place of
Your content here. - The crafted content terminates the Python triple-quoted literal or introduce ...[truncated 1304 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not construct Python source code or shell commands by inserting post content into
python -c. - Provide a fixed, reviewed Python script whose code is never generated from user input.
- Transfer post content through standard input, a structured JSON file, or a separately supplied process argument.
- Invoke the fixed script with an argument array and without a shell, such as through
subprocess.run([...], shell=False). - Parse structured input with a JSON library and pass the resulting string directly to
client.post. - Validate platform names against an explicit allowlist and validate media URLs before posting.
- Require a preview and explicit user confirmation before performing the externally visible posting action.
- Run the posting client with least privilege and restrict access to
.envand provider credentials. - Avoid printing credentials or including them in command-line arguments, logs, error messages, or generated source.
- Add tests containing triple quotes, quotation marks, backticks, dollar-sign substitutions, newlines, and other metacharacters to verify that all content remains inert data.
- Do not construct Python source code or shell commands by inserting post content into