T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:228
- Finding
- Shell Command Injection Through Untrusted Advertisement URLs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 228-230 and 260-273 **Vulnerability Type**: Command injection caused by unsafe shell interpolation **Risk Level**: High ### Vulnerable Code Snippet ```bash curl -sIL -o /dev/null -w "%{http_code} %{url_effective}\n" <URL> ``` The surrounding instructions direct the agent to extract URLs from structured creative fields and free-form advertisement body content, then substitute those values into the command. ### Technical Analysis Advertisement destination URLs and free-form creative body fields are externally controlled data. The documented command places the extracted value directly into a shell command without requiring argument-array execution, scheme validation, shell escaping, or even mandatory quoting. If the agent performs textual substitution and invokes the command through a shell, shell metacharacters in a crafted value can terminate or extend the intended `curl` command. Redirect targets also require validation because an initially legitimate URL can redirect to an unsafe scheme, internal resource, or unexpected destination. The issue is especially severe because the agent environment may contain Meta access tokens, Habilis credentials, advertising account identifiers, and local Hermes configuration files. ### Attack Path 1. An attacker obtains control over an advertisement creative, destination field, affiliate link, shortened link, or free-form body field that the Skill audits. 2. The attacker inserts a value containing shell metacharacters and an additional command. 3. The Skill extracts the value as a destination URL. 4. The agent substitutes it into the documented `curl` command and executes it through a shell. 5. The shell interprets the injected portion as a separate command. 6. The injected command executes with the same operating-system privileges as the agent. ### Impact Assessment Successful exploitation could permit arbitrary command execution under the agent ...[truncated 599 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not invoke a shell to test URLs. Use an HTTP client API with arguments passed as structured values. - If a subprocess is necessary, use an argument array such as `["curl", "-sIL", ..., url]` with shell processing disabled. - Permit only `http` and `https` schemes. - Reject control characters, whitespace anomalies, shell metacharacters, embedded credentials, and malformed hostnames. - Apply DNS and IP validation to prevent access to loopback, link-local, private, metadata, and other internal network ranges. - Revalidate every redirect destination. - Enforce request timeouts, response-size limits, and a maximum redirect count. - Run URL checks in a network-restricted sandbox without access to credentials. - Add regression tests using URLs containing semicolons, command substitution, newlines, pipes, redirects, and encoded metacharacters. ]]>