T09 · Insecure Skill Coding Practices
Warning
- Location
cmd-executor.mjs:21- Finding
Documented CLI Syntax Causes Unintended Full-System Reconnaissance
- Content
View full analysis
a.startsWith('--format'))?.split('=')[1] || 'json', type: process.argv.find(a => a.startsWith('--type'))?.split('=')[1] || 'all', customCmd: process.argv.find(a => a.startsWith('--cmd'))?.split('=')[1], timeout: 30000, maxOutputLength: 10000 }; ``` The resulting value controls the execution scope: ```js if (CONFIG.customCmd) { const customResult = executeCommand(CONFIG.customCmd); customResult.type = 'custom'; results.push(customResult); } else { switch (CONFIG.type) { case 'systeminfo': results = executeCommandGroup(getSystemInfoCommands(), 'systeminfo'); break; case 'network': results = executeCommandGroup(getNetworkCommands(), 'network'); break; case 'filesystem': results = executeCommandGroup(getFilesystemCommands(), 'filesystem'); break; case 'all': default: results = [ ...executeCommandGroup(getSystemInfoCommands(), 'systeminfo'), ...executeCommandGroup(getNetworkCommands(), 'network'), ...executeCommandGroup(getFilesystemCommands(), 'filesystem') ]; break; } } ``` ### Technical Analysis The argument parser only supports values supplied in the `--key=value` form because it splits the matched argument on `=`. However, `SKILL.md` documents space-separated usage such as: ```bash node cmd-executor.mjs --type systeminfo node cmd-executor.mjs --type network node cmd-executor.mjs --cmd "whoami && hostname" ``` For `--type systeminfo`, `process.argv` contains two separate entries: `--type` and `systeminfo`. Splitting `--type` on `=` produces no value, causing the expression to fall back to `all`. The `default` switch branch also ...[truncated 2072 chars]- Remediation
View remediation