T09 · Insecure Skill Coding Practices
Note
- Location
- scripts/tournament.sh:10
- Finding
- Unsafe JSON Construction from User-Controlled Agent Name## Vulnerability Details **File Location**: `scripts/tournament.sh`, lines 10-14 **Vulnerability Type**: JSON payload injection caused by unsafe string interpolation **Risk Level**: Low ### Vulnerable Code ```bash register) read -p "Agent name: " NAME curl -s -X POST "$API_BASE/register" \ -H "Content-Type: application/json" \ -d "{\"name\": \"$NAME\", \"ref\": \"ref_27fcab61\"}" | python3 -m json.tool ;; ``` ### Technical Analysis The script reads an agent name from standard input and inserts it directly into a JSON string without JSON-aware escaping. Characters such as double quotes, backslashes, and control characters can invalidate the request or change its logical structure. Shell command injection is not established because the expansion of `NAME` occurs inside a quoted shell argument. However, the quoting does not protect the JSON document itself. A crafted name can introduce additional properties if the resulting payload is accepted by the remote registration service. For example, an input similar to: ```text x", "role": "admin", "unused": " ``` would cause the generated request body to contain attacker-controlled JSON structure rather than treating the entire input solely as an agent name. The actual server-side effect depends on how strictly the remote API validates and filters registration properties. ### Attack Path 1. An attacker or untrusted caller invokes `bash scripts/tournament.sh register`. 2. The caller supplies an agent name containing JSON syntax, including quotes and additional properties. 3. The script interpolates the value into the `curl -d` argument without JSON encoding. 4. The altered payload is transmitted to `https://agent.rollhub.com/api/v1/register`. 5. If the service accepts unexpected or duplicate fields, the attacker may manipulate registration attributes beyond the intended `name` value. This path does not grant local shell execution, filesystem acc ...[truncated 611 chars]
- Remediation
- ## Remediation Suggestions Construct the request body with a JSON serializer rather than manual string interpolation: ```bash payload="$( python3 -c 'import json, sys; print(json.dumps({ "name": sys.argv[1], "ref": "ref_27fcab61" }))' "$NAME" )" curl -sS -X POST "$API_BASE/register" \ -H "Content-Type: application/json" \ --data-binary "$payload" | python3 -m json.tool ``` Additionally: - Enforce a reasonable length limit and documented character policy for agent names. - Reject control characters before sending the request. - Use `curl --fail-with-body` so HTTP failures are surfaced reliably. - Require the server to allowlist registration fields and reject unknown or duplicate properties. - Do not rely on client-side validation as the API's only security boundary.