T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cultural_tourism_report.py:530- Finding
Shell Command Injection in Cron Subscription Installation
- Content
View full analysis
/dev/null; echo "{cron_line}") | crontab -', shell=True, check=True, capture_output=True ) ``` ### Technical Analysis The `keyword` value comes from the user-controlled `--keyword` command-line argument. It is concatenated into `cron_line`, which is then interpolated into a command executed with `shell=True`. No shell escaping, input validation, or safe argument serialization is applied. An attacker can include a double quote, command substitution, command separator, redirection operator, or other shell metacharacters in the keyword. This can escape the intended `echo` argument and cause the shell to execute additional commands. The use of `shell=True` is unnecessary for the declared reporting functionality and exposes the full privileges of the user running the Skill. ### Attack Path 1. An attacker supplies a crafted keyword and requests subscription installation. 2. The value reaches `args.keyword` without validation. 3. `install_subscription(args.keyword)` incorporates it into `cron_line`. 4. The resulting string is embedded in a larger shell pipeline. 5. `subprocess.run(..., shell=True)` passes the string to the system shell. 6. Shell metacharacters in the keyword cause attacker-selected commands to execute. 7. The commands run with the permissions of the Agent or user invoking the Skill. For example, a keyword containing a terminating quote and shell separator could alter the generated command rather than being treated solely as search text. ### Impact Assessment Successful exploitation provides arbitrary command execution ...[truncated 466 chars]- Remediation
View remediation