T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:32
- Finding
- Shell Command Injection Through Insufficient Domain Validation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 32-47; duplicated in `skill/SKILL.md`, lines 32-47 **Vulnerability Type**: Shell command injection through unsafe interpolation **Risk Level**: High ### Vulnerable Code ```markdown ## Domain handling Extract a bare domain from the user request: - Strip `http://`, `https://`, paths, query strings, ports, and trailing dots. - Keep the registered domain or hostname the user clearly asked about. - Do not scan private hostnames unless the user explicitly says the hostname is public. ## Default workflow ### 1. Run the fast scan first Use this for almost every domain-specific request: ```bash curl -s "https://intodns.ai/api/scan/quick?domain=DOMAIN" ``` ``` ### Technical Analysis The Skill instructs the agent to derive `DOMAIN` from untrusted user input and interpolate it into a shell command. The documented normalization only removes URL components; it does not require the result to match a strict DNS hostname grammar or reject shell metacharacters. Double quotes do not suppress command substitution in common shells. If the agent replaces `DOMAIN` with input containing constructs such as `$(command)` or backticks and executes the resulting command through a shell, the embedded command is evaluated locally before `curl` runs. The same vulnerable instructions are present in both copies of the Skill definition. ### Attack Path 1. An attacker submits a scan request containing text presented as a domain but including shell substitution syntax. 2. The Skill applies its documented normalization, which does not explicitly reject `$`, parentheses, backticks, quotes, whitespace, or other shell-significant characters. 3. The agent inserts the resulting value into the provided double-quoted `curl` command. 4. A shell evaluates the command-substitution expression before invoking `curl`. 5. The injected command executes with the operating-system privileges of the agent or Skill runtime. Exploita ...[truncated 744 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate the extracted value using a strict hostname parser before performing any request: - Permit only valid DNS labels containing ASCII letters, digits, hyphens, and dots. - Enforce DNS label and total-length limits. - Reject empty labels, leading or trailing hyphens, whitespace, control characters, shell metacharacters, and unexpected Unicode. - Handle internationalized domains through an explicit, validated IDNA-to-ASCII conversion. 2. Do not construct a shell command by concatenating user input. Invoke the HTTP client through an argument-array or native HTTP API where shell parsing does not occur. 3. If `curl` must be used, bind and encode the value as a separate argument: ```bash curl --silent --show-error --get \ --data-urlencode "domain=$domain" \ "https://intodns.ai/api/scan/quick" ``` The runtime must still pass these as discrete process arguments rather than assembling the displayed text into a shell command. 4. Add explicit instructions requiring rejection of invalid input rather than attempting to sanitize arbitrary text into a domain. 5. Apply the remediation consistently to both `SKILL.md` and `skill/SKILL.md`, and add tests covering command substitutions, backticks, quotes, whitespace, control characters, malformed labels, and URL-encoded metacharacters. ]]>