T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:119
- Finding
- Shell Command Injection Through User-Derived Command Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:119-122` **Vulnerability Type**: Command injection **Risk Level**: High ### Vulnerable Code ```markdown 3. **Write to the log file** - Determine today's date - Run the log manager script: ```bash python scripts/log_manager.py append --date {today_date} --data '{json_data}' ``` ``` Related retrieval workflows also construct shell commands using derived date values: ```bash python scripts/log_manager.py read --date {target_date} python scripts/log_manager.py read_week --date {target_date} ``` ### Technical Analysis The Skill instructs the Agent to interpolate structured feedback and date values directly into shell command text. In particular, `{json_data}` is placed inside single quotes without specifying a shell-safe encoding or escaping procedure. A feedback value containing a single quote can terminate the quoted argument. Subsequent shell metacharacters can then introduce an additional command. Validation performed by `argparse`, `json.loads`, or `datetime.strptime` does not mitigate this issue because the shell parses and executes the command line before the Python process receives its arguments. Although `scripts/log_manager.py` does not itself invoke a shell, the documented Skill workflow creates the vulnerable execution boundary by requiring the Agent to construct and run a Bash command from user-derived content. ### Attack Path 1. An attacker submits caregiver feedback containing a crafted quote and shell syntax, conceptually similar to: ```text '; attacker_command; # ``` 2. The Agent converts the feedback into JSON but embeds that JSON directly into the documented command: ```bash python scripts/log_manager.py append --date 2026-09-12 --data '{attacker_controlled_json}' ``` 3. The injected single quote terminates the intended `--data` argument. 4. The shell interprets the remaining metacharacters and attacker-controlled command as separate s ...[truncated 940 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not construct a shell command string from feedback or date values. 2. Invoke the script through a process API that accepts an argument array and does not enable shell parsing. For example: ```python subprocess.run( [ sys.executable, "scripts/log_manager.py", "append", "--date", validated_date, "--data", json.dumps(data, ensure_ascii=False), ], shell=False, check=True, ) ``` 3. Prefer passing feedback through standard input or a securely created JSON file rather than a command-line argument. This also reduces exposure through process listings. 4. Validate every date before process invocation using a strict `YYYY-MM-DD` parser. Do not pass the original user expression to a shell. 5. If shell execution cannot be avoided, apply platform-appropriate argument quoting through a proven library rather than manual replacement. This is a secondary mitigation and is less robust than eliminating the shell. 6. Add tests containing quotes, command substitutions, semicolons, newlines, and other shell metacharacters to verify that they remain literal data. 7. Run the Skill with least privilege and restrict filesystem and network access to reduce the impact of any future command-execution flaw. ]]>