T09 · Insecure Skill Coding Practices
Error
- Location
assets/subscribe.py:690- Finding
Shell Command Injection in Cron Task Management
- Content
View full analysis
/dev/null; echo "{cron_line}") | crontab -', shell=True, check=True, capture_output=True ) ``` The related task-removal code at lines 721–726 is also unsafe: ```python script_path = os.path.abspath(__file__) try: subprocess.run( f'crontab -l 2>/dev/null | grep -v "{script_path}" | crontab -', shell=True, check=True, capture_output=True ) ``` ### Technical Analysis The absolute path of the Skill script is interpolated directly into shell commands executed with `shell=True`. No shell quoting or escaping is applied. Although `script_path` is not supplied as a normal command-line argument, it depends on the directory into which the Skill package is installed or extracted. If that directory contains shell metacharacters, command substitution syntax, quotes, or newline characters, the shell can interpret part of the path as executable syntax. The removal operation introduces an additional integrity problem: the path is passed to `grep` as an unescaped regular expression. Regex metacharacters in the path can cause unrelated cron entries to be removed. The scheduled task itself supports the documented daily-fetch feature and is installed only when the user requests `--subscribe`. Therefore, the persistence behavior is not independently classified as malicious system persistence. The vulnerability is the unsafe shell construction used to implement it. ### Attack Path 1. An attacker distributes or arranges extraction of the Skill under a directory name containing shell syntax. 2. The victim or an AI Agent invokes: ```b ...[truncated 1246 chars]- Remediation
View remediation