T09 · Insecure Skill Coding Practices
- Location
SKILL.md:100- Finding
Command Injection Through Unvalidated Knowledge Base Path
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 100-110
Vulnerability Type: PowerShell command injection through unsafe configuration interpolation
Risk Level: MediumVulnerable Code
powershell # Scan files in a specified directory, sorted by name Get-ChildItem -Path "{{knowledge_base_path}}02_绘画技法\水彩教程" -File | Sort-Object Name | Select-Object Name, @{N='MB';E={[math]::Round($_.Length/1MB,1)}} | Format-Table -AutoSize -Wrap # Search by keyword Get-ChildItem -Path "{{knowledge_base_path}}" -Recurse -File | Where-Object { $_.Name -match "素描|水彩|解剖" } | Sort-Object Name | Select-Object Name, @{N='MB';E={[math]::Round($_.Length/1MB,1)}} | Format-Table -AutoSize # Display the number and total size of books in a category Get-ChildItem -Path "{{knowledge_base_path}}04_艺术史论" -Recurse -File | Measure-Object -Property Length -Sum | ForEach-Object { "Book count: $($_.Count) | Total size: $([math]::Round($_.Sum/1GB,2)) GB" }Technical Analysis
The user-configurable
knowledge_base_pathvalue is inserted directly into double-quoted PowerShell commands that the skill instructs the agent to run throughexec. The skill does not require validation, canonicalization, escaping, or argument-safe process invocation before interpolation.PowerShell treats characters such as double quotes, semicolons, pipes, subexpressions, and comment markers as syntax. A malicious configuration value can therefore terminate the intended
-Pathargument and append another command. For example, a value shaped likeC:\Books"; whoami; #would close the path string, executewhoami, and comment out the generated suffix.This vulnerability applies when an attacker can set or modify the skill configuration, or can persuade a user or agent to use an attacker-provided path. Merely scanning a legitimate configured path does not trigger exploitation.
Attack Path
- An attacker obtains influence over the configured `kn ...[truncated 1212 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not construct a PowerShell command by concatenating or interpolating
knowledge_base_path. - Prefer a dedicated filesystem enumeration API or agent tool that accepts the directory as a structured argument without invoking a shell.
- If PowerShell is unavoidable, pass the path through a parameterized script or process argument array rather than embedding it in command text.
- Canonicalize the configured path and require it to resolve to an existing directory.
- Restrict access to explicitly approved knowledge-base roots and reject paths that escape those roots.
- Reject control characters and PowerShell metacharacters, including quotes, semicolons, pipes, backticks, dollar-sign expressions, newlines, and comment markers.
- Apply least privilege to the agent process so it cannot access unrelated sensitive directories.
- Require explicit user confirmation before recursively scanning a broad directory.
- Add tests using malicious path values to verify that configuration input is always handled as literal path data and can never alter command structure.
- Do not construct a PowerShell command by concatenating or interpolating