T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:47- Finding
Command Injection Through Untrusted Douyin Page Metadata
- Content
View full analysis
' \ DOUYIN_TITLE='' \ DOUYIN_AUTHOR='<author>' \ node '<技能目录>/scripts/transcribe.js' '<用户消息中的最后一个抖音链接>' ``` ### Technical Analysis The values substituted for `audioUrl`, `title`, and `author` originate from a remote webpage and must therefore be treated as untrusted input. The documented command places those values inside single-quoted shell strings without specifying a safe escaping procedure. A single quote in any substituted value terminates its shell string. The remainder of a malicious value can then introduce shell operators or command substitutions. For example, a title conceptually shaped as: ```text '; attacker_command; # ``` would cause the generated shell command to execute `attacker_command` rather than treating the entire title as data. The positional Douyin source URL is interpolated using the same unsafe pattern. Although legitimate Douyin URLs normally contain a limited character set, the instructions do not establish strict URL parsing and validation before command construction. The JavaScript implementation in `scripts/transcribe.js` does not itself invoke a shell. The flaw is in the Skill instructions directing the Agent to construct and execute an unsafe shell ...[truncated 1478 chars]- Remediation
View remediation