T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:61- Finding
Shell Command Injection Through Unquoted User-Controlled Arguments
- Content
View full analysis
# use local file: python3 skills/wps-ocr/scripts/wps_ocr.py --path ``` Equivalent instructions from `SKILL_zh.md:68-70`: ```bash # 使用下载链接： python3 skills/wps-ocr/scripts/wps_ocr.py --url <用户提供的文件 URL> # 本地文件： python3 skills/wps-ocr/scripts/wps_ocr.py --path <用户提供的文件 PATH> ``` ### Technical Analysis The execution instructions direct an AI Agent to construct a shell command by inserting a user-provided URL or local path directly into the command line. They do not require argument-array invocation, prohibit shell evaluation, or prescribe shell-safe quoting. If the Agent invokes the resulting text through a shell, metacharacters within the supplied URL or path can be interpreted by the shell before `wps_ocr.py` starts. Consequently, validation in `URLValidator` and `FileValidatorAndReader` cannot prevent this vulnerability because the injected command executes before Python receives the intended argument. The Python script itself does not construct a subprocess or invoke a shell. The vulnerability arises from the Skill's documented execution pattern and is exploitable only when the calling Agent interpolates untrusted input into a shell command as shown. ### Attack Path 1. An attacker submits an OCR request with a URL or local-file value containing shell metacharacters and an additional command. 2. The Agent follows the Skill instructions and substitutes that value directly into the documented command template. 3. The Agent executes the constructed command through a shell. 4. The shell parses the attacker-controlled metacharacters rather than passing the entire val ...[truncated 876 chars]- Remediation
View remediation