T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:36- Finding
User-Controlled Cryptocurrency Symbol Enables Shell Command Injection
- Content
View full analysis
./crypto_chart__.png` 2. Send: `message(action="send", filePath="./crypto_chart__.png", message="")` 3. **MANDATORY cleanup** — run both commands regardless of send result: - `rm ./crypto_chart__.png` - `rm ` 4. Reply `NO_REPLY`. ``` `scripts/get_price_chart.py:831-839` accepts the symbol without enforcing a safe-character policy: ```python def main(): if len(sys.argv) < 2: return _json_error("missing symbol", "Usage: get_price_chart.py ") raw_symbol = sys.argv[1].strip() if not raw_symbol: return _json_error("missing symbol", "Usage: get_price_chart.py ") symbol_upper = raw_symbol.upper() token_id = TOKEN_ID_MAP.get(symbol_upper) if token_id is None: token_id = raw_symbol.lower() ``` `scripts/get_price_chart.py:797-800` embeds that symbol in a filesystem path: ```python ts = int(time.time()) chart_path = f"/tmp/crypto_chart_{symbol}_{ts}.png" fig.tight_layout() fig.savefig(chart_path, dpi=150) ``` `scripts/get_price_chart.py:975-976` returns the path to the agent: ```python "chart_path": chart_path, "text": text, ``` ### Technical Analysis The cryptocurrency symbol originates from user-controlled input and is only stripped of leading and trailing whitespace. It is not restricted to letters, digits, or a narrowly defined set of safe separators. The symbol is subsequently embedded in the generated ch ...[truncated 2917 chars]- Remediation
View remediation