T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:32- Finding
Shell Command Injection Through Unescaped Trade Thesis Input
- Content
View full analysis
","side":"","thesis":"","bankrollUsd":null}' ``` ### Technical Analysis The workflow instructs the agent to substitute the user-provided symbol and thesis directly into a single-quoted shell argument. Although the intended request body is JSON, JSON encoding does not protect a value from shell parsing. A single quote in the thesis can terminate the shell argument containing the JSON. The attacker can then insert shell metacharacters and additional commands. The trailing portion of the intended command can be suppressed with a shell comment. The symbol field presents the same underlying risk if it is not strictly validated. The issue occurs before the request reaches the remote API. It therefore does not depend on compromising or manipulating the API server; it is exploitable whenever an agent constructs and executes the documented command through a shell using raw user input. ### Attack Path 1. An attacker asks the skill to review a trade and supplies an otherwise plausible symbol and side. 2. The attacker places shell syntax in the thesis, such as: ```text '; touch /tmp/trade-jury-injection-proof; # ``` 3. The agent replaces the `` placeholder with the attacker-controlled text. 4. The injected single quote closes the `curl -d` argument, the semicolon starts a new command, and the comment character suppresses the remaining shell text. 5. The shell executes the injected command with the same operating-system identity and permissions as the agent process. 6. A real attacker could replace the harmless proof command with commands that read accessible files, alter workspace content ...[truncated 840 chars]- Remediation
View remediation