T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:82
- Finding
- Shell Command Injection Through Unsafely Interpolated Search Terms## Vulnerability Details **File Location**: `SKILL.md`, lines 82–100 **Vulnerability Type**: Unsanitized user input in generated shell commands **Risk Level**: High ### Vulnerable Code ```bash curl -s "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -d '{ "api_key": "'$TAVILY_API_KEY'", "query": "TERMO", "max_results": 8, "include_answer": true, "include_images": true }' ``` ```bash curl -s "https://api.search.brave.com/res/v1/web/search?q=TERMO&count=5" \ -H "Accept: application/json" \ -H "X-Subscription-Token: $BRAVE_SEARCH_API_KEY" ``` ### Technical Analysis The Skill instructs the Agent to insert a user-controlled search term into shell command text. It does not require JSON serialization, URL encoding, shell-safe argument handling, or validation before the command is executed. In the Tavily command, the query is embedded in a shell-quoted JSON document. A search term containing quote characters and shell syntax could terminate the intended quoting context if the Agent performs direct textual substitution. The resulting text would then be interpreted by the shell as additional commands or arguments. In the Brave command, the query is placed inside a double-quoted URL without URL encoding. Shell-sensitive constructs inserted into generated command text may be evaluated when the shell parses the command. Independently of command execution, characters such as `&`, `#`, `?`, and whitespace can alter the request structure or inject unintended query parameters. Although transmitting search terms and API credentials to Tavily and Brave is consistent with the declared search functionality, constructing those requests through interpolated shell source exceeds what is necessary. Structured HTTP requests can provide the same functionality without exposing a command-execution boundary. ### Attack Path 1. An attacker sends a message containing the ...[truncated 1776 chars]
- Remediation
- ## Remediation Suggestions 1. Do not generate or execute shell source from search terms. Use a structured HTTP client or a trusted search tool that accepts separate URL, header, and body parameters. 2. Serialize the Tavily request body with a JSON library so the query and API key are encoded as data rather than embedded into a command string. 3. Construct the Brave URL with a URL API or query-parameter encoder. The search term must be percent-encoded rather than concatenated into the URL. 4. If invoking `curl` is unavoidable, launch it without a shell using an argument array. Pass each header, URL, and request body as a distinct process argument. 5. Never use `eval`, `sh -c`, `bash -c`, or equivalent mechanisms with user-derived input. 6. Add tests covering quotes, command substitutions, semicolons, ampersands, newlines, Unicode, and unusually long search terms. 7. Keep API keys in scoped secret storage or environment variables, restrict their provider-side permissions, apply usage limits, and rotate them if command injection may previously have been possible. 8. Restrict the Agent runtime with filesystem, process, and outbound-network controls so a request-formatting defect cannot expose unrelated resources.