T09 · Insecure Skill Coding Practices
Error
- Location
scripts/daily_popular_report.py:14- Finding
Shell Command Injection Through Unescaped Browser Command Arguments
- Content
View full analysis
"{save_path}" 2>&1' out, err, rc = run_cmd(cmd, timeout=20) ``` ### Technical Analysis `run_cmd()` passes a dynamically constructed string to `subprocess.run()` with `shell=True`. Both `browser_open()` and `browser_snapshot()` interpolate function arguments directly into quoted shell commands without shell escaping. Quotation marks alone do not provide a security boundary. An argument containing a quote followed by shell syntax can terminate the quoted value and append another command. Redirection syntax is also deliberately interpreted by the shell in `browser_snapshot()`. The current `main()` function primarily supplies fixed URLs and stock-derived URLs containing six-digit tickers, which reduces exposure through the default execution path. However, the helper functions themselves accept unrestricted strings and are callable by imported code or future integrations. Any path that forwards untrusted input to these functions creates a command-execution vulnerability. ### Attack Path 1. An attacker influences a URL or snapshot output path passed to `browser_open()` or `bro ...[truncated 1289 chars]- Remediation
View remediation