T09 · Insecure Skill Coding Practices
Error
- Location
scripts/launch_claude_code.sh:90- Finding
Shell Command Injection Through Crafted Project Paths
- Content
View full analysis
/dev/null | head -5 || true exit 1 fi if [[ ! -w "$project" ]]; then error "No write permission for: $project" exit 1 fi success "Project validated: $(basename "$project")" echo "$project" } ``` ```bash navigate_to_project() { local project="$1" info "Navigating to project: $project" if peekaboo type "cd \"$project\"" --app Terminal --return 2>/dev/null; then success "Navigated to project" sleep 1 else error "Failed to navigate to project" return 1 fi } ``` The returned value is captured and subsequently passed to the vulnerable function: ```bash PROJECT_PATH=$(validate_project "$PROJECT_PATH") open_terminal navigate_to_project "$PROJECT_PATH" ``` ### Technical Analysis The launcher validates only that the supplied project path identifies an existing writable directory. It does not encode the path safely before inserting it into a command that is typed into an interactive shell. The construction below is not sufficient shell escaping: ```bash peekaboo type "cd \"$project\"" --app Terminal --return ``` A directory name can legally contain characters such as double quotes, semicolons, backticks, dollar signs, command substitutions, and newline characters. An embedded double quote can terminate the intended quoted path, after which shell syntax in the directory name can introduce additional commands. Peekaboo's `--return` opti ...[truncated 1734 chars]- Remediation
View remediation
&2 printf '%s\n' "$project" ``` 4. Use `realpath` or an equivalent canonicalization mechanism and reject paths containing newline or carriage-return characters as defense in depth. 5. Add automated tests using directory names containing spaces, quotes, semicolons, command substitutions, backticks, leading hyphens, and newlines. 6. Do not treat existence and writability checks as input sanitization; retain shell-safe argument handling at the command-execution boundary. ]]>