T09 · Insecure Skill Coding Practices
Error
- Location
build.sh:7- Finding
PowerShell Command Injection Through an Unvalidated Build Version
- Content
View full analysis
/ai-support-pro-v.zip set -euo pipefail SRC_DIR="$(cd "$(dirname "$0")" && pwd)" SLUG="ai-support-pro" # Версия из SKILL.md или переопределённая аргументом if [[ -n "${1:-}" ]]; then VER="$1" else VER="$(grep '^version:' "$SRC_DIR/SKILL.md" | head -1 | sed -E 's/version: *//' | tr -d ' ')" fi [[ -z "$VER" ]] && { echo "ERROR: version not detected"; exit 1; } OUT_DIR="$(cd "$SRC_DIR/.." && pwd)/zips-v${VER}" ZIP_NAME="${SLUG}-v${VER}.zip" STAGE_DIR="$(mktemp -d)/${SLUG}-v${VER}" echo "==> Building $ZIP_NAME (ver=$VER)" echo " Source : $SRC_DIR" echo " Output : $OUT_DIR/$ZIP_NAME" mkdir -p "$OUT_DIR" mkdir -p "$STAGE_DIR" # ... elif command -v powershell.exe >/dev/null 2>&1 || command -v powershell >/dev/null 2>&1; then PSH="$(command -v powershell.exe 2>/dev/null || command -v powershell)" WIN_SRC="$(cygpath -w "$(pwd)/$(basename "$STAGE_DIR")" 2>/dev/null || echo "$(pwd)/$(basename "$STAGE_DIR")")" WIN_OUT="$(cygpath -w "$OUT_DIR/$ZIP_NAME" 2>/dev/null || echo "$OUT_DIR/$ZIP_NAME")" "$PSH" -NoProfile -Command "Compress-Archive -Path '${WIN_SRC}' -DestinationPath '${WIN_OUT}' -Force" ``` ### Technical Analysis The script accepts its first argument as `VER` without validating that it is a valid semantic version. The value then influences: - `OUT_DIR` - `ZIP_NAME` - `STAGE_DIR` - The PowerShell `Compress-Archive` command On systems where neither `zip` nor `7z` is available, the script uses PowerShell as its fallback archiver. It constructs PowerShell source code by interpolating `WIN_SRC` and `WIN_OUT` into a string passed to `powershell -Command`. Although the relevant shell variables are quoted for Bash, that quoting does not protect the values from the second-stage ...[truncated 2356 chars]- Remediation
View remediation