T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:34- Finding
Shell Command Injection Through Unsafely Embedded Document Content
- Content
View full analysis
", "metadata": {"title": "", "source": ""}}' ``` ### Technical Analysis The Skill instructs the Agent to place document content and metadata directly into a single-quoted shell argument and then execute the resulting command through the `exec` tool. The document text, title, and source can contain attacker-controlled characters. A single quote in supplied content can terminate the shell string. The attacker can then introduce shell operators and commands before commenting out or otherwise neutralizing the remaining template. JSON escaping alone does not prevent this vulnerability because JSON escaping and shell escaping are separate operations. For example, content structured conceptually as `' ; ; #` could escape the `-d` argument if substituted directly into the command template. The precise payload would depend on how the Agent performs placeholder substitution. ### Attack Path 1. An attacker supplies a document or ingestion request containing shell metacharacters and a single quote. 2. The Agent follows the Skill and substitutes the supplied content into ``. 3. The Agent sends the constructed command to the shell-backed `exec` tool. 4. The single quote closes the intended JSON argument. 5. Shell operators cause the attacker's appended command to execute. 6. The injected process runs with the same operating-system privileges and environment access as the Agent. ### Impact Assessment Successful exploitation can provide arbitrary command execution under the Agent's operating ...[truncated 513 chars]- Remediation
View remediation