T09 · Insecure Skill Coding Practices
Error
- Location
skill.js:4- Finding
Unrestricted Message-to-Shell Command Execution
- Content
View full analysis
{ exec(cmd, { maxBuffer: 1024 * 1024 }, (err, stdout, stderr) => { if (err) reject(`${stdout}${stderr}`); else resolve(stdout + stderr); }); }); return out.trim(); ``` The related trigger configuration is: ```yaml pattern: "^Run command:\s*.*" ``` ### Technical Analysis The skill obtains attacker-controlled text from `context.message`, removes an optional `Run command:` prefix, and passes the remaining content directly to Node.js `child_process.exec()`. `exec()` invokes a system shell, so the input is interpreted as shell syntax rather than as a fixed executable and safely separated argument list. There is no command allowlist, argument validation, authorization check, confirmation step, sandbox, execution timeout, or privilege restriction. Shell operators, command chaining, redirection, and other shell-specific constructs are consequently available to the requester. The prefix removal does not provide a security boundary. Although `task.yml` is configured to trigger on messages beginning with `Run command:`, the implementation itself does not require that prefix to be present. If the exported function can be invoked through another route, the entire message may still be executed. The skill also returns combined standard output and standard error to the requester. Commands that read sensitive local information can therefore expose that information through the normal skill response. ### Attack Path 1. An attacker or unauthorized user gains the ability to submit a me ...[truncated 1703 chars]- Remediation
View remediation