T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:35
- Finding
- Potential Shell Command Injection Through TTS Text Interpolation## Vulnerability Details **File Location**: `SKILL.md`, line 35 **Vulnerability Type**: Shell command injection **Risk Level**: High ```bash bin/sherpa-onnx-tts /tmp/reply.ogg "Tu mensaje aquí" ``` ### Technical Analysis The manual execution instructions encourage placing generated response text directly inside a shell command. The response may be influenced by an untrusted voice transcript. If an agent or implementation replaces the placeholder with response text through string interpolation and invokes it through a shell, embedded quotation marks, command substitutions, or shell metacharacters could escape the intended argument. For example, response content containing a closing quotation mark followed by shell syntax could alter the command structure. The documented quotation marks alone do not safely parameterize untrusted data. Exploitability depends on the downstream implementation invoking the resulting command through a shell rather than passing arguments directly to the executable. ### Attack Path 1. An attacker submits a crafted WhatsApp audio message. 2. The local transcription process converts the audio into text containing instructions or shell metacharacters. 3. The transcript influences the response supplied to the TTS command. 4. The agent or integration replaces `"Tu mensaje aquí"` with that response using direct string interpolation. 5. The constructed command is executed through a shell. 6. Malicious shell syntax escapes the intended TTS argument and executes commands with the privileges of the agent process. ### Impact Assessment Successful exploitation could permit arbitrary command execution under the operating-system account running the skill. The attacker could read or modify files accessible to that account, access locally available credentials, alter generated messages, invoke installed tools, or interfere with other skill operations. This issue does not independently demonstrate privilege esc ...[truncated 33 chars]
- Remediation
- ## Remediation Suggestions - Never construct the TTS invocation by concatenating response text into a shell command. - Invoke `bin/sherpa-onnx-tts` through an argument-array API that bypasses shell parsing, such as an equivalent of `execve()` or `subprocess.run([...], shell=False)`. - If supported by the TTS program, provide text through standard input or a securely created input file. - Treat transcriptions and generated responses as untrusted data. - Enforce response-size limits and validate the expected text encoding. - Add tests containing quotation marks, command substitutions, newlines, and shell metacharacters to confirm that all content remains a single inert argument.