T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:62- Finding
Shell Command Injection Through Unescaped User Answers
- Content
View full analysis
"" --topic ``` The same unsafe invocation pattern appears again: ```bash recallit answer "" --topic ``` ### Technical Analysis The Skill directs the agent to insert the user's exact answer into a shell command enclosed only in double quotes. If the command is submitted to a shell, double quotes do not prevent command substitution through constructs such as `$(command)` or backticks. An embedded double quote may also terminate the intended argument and introduce additional shell syntax. The answer is explicitly attacker-controlled and is not escaped, validated, passed through standard input, or supplied through a process API that disables shell parsing. Card and topic identifiers are also represented as interpolated placeholders without documented validation. For example, an answer containing the following could trigger command substitution when the documented command is evaluated by a shell: ```text $(attacker-controlled-command) ``` This is an insecure command-construction pattern even though the stated purpose is merely to pass a quiz answer to the grading CLI. ### Attack Path 1. The agent begins a recall session and presents a card to the user. 2. A malicious user submits an answer containing shell substitution or quote-breaking syntax. 3. The agent follows `SKILL.md` and inserts the exact reply into the documented command. 4. The shell evaluates the injected syntax before or while launching `recallit`. 5. The attacker's command executes with the same operating-system identity and environment as the agent. ### Impact Assessment Successful exploitation can provide arbitrary command execution with the agent's current privileges. T ...[truncated 396 chars]- Remediation
View remediation