T09 · Insecure Skill Coding Practices
- Location
SKILL.md:38- Finding
Shell Command Injection Through Unsafe Request-Data Interpolation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 38–42 and 67–71
Vulnerability Type: Command injection caused by unsafe interpolation of untrusted input into shell commands
Risk Level: HighVulnerable code at lines 38–42:
bash curl -s -X POST "https://sdk.senso.ai/api/v1/search" \ -H "Content-Type: application/json" \ -H "X-API-Key: ${SENSO_API_KEY}" \ -d '{"query": "<user's question>", "top_k": 5}'Vulnerable code at lines 67–71:
bash curl -s -X POST "https://sdk.senso.ai/api/v1/generate" \ -H "Content-Type: application/json" \ -H "X-API-Key: ${SENSO_API_KEY}" \ -d '{"query": "<user question>", "context": "<concatenated search result passages>"}'Technical Analysis
The skill instructs the agent to invoke
curlthrough theexectool and replace placeholders inside single-quoted shell arguments. The values placed into these arguments can include a user-controlled question and, for the generation endpoint, passages returned by an external API.A single quote in either value can terminate the shell's quoted argument. Additional shell operators can then be interpreted as commands rather than request data. Manual JSON construction also mishandles legitimate quotation marks, backslashes, control characters, and newlines, even when an input is not intentionally malicious.
The second command increases the exposed input surface because both the user's query and externally sourced document passages may be inserted into the command. The vulnerability is exploitable when an agent implements the documented placeholders through direct textual substitution before passing the resulting command to a shell.
Attack Path
- An attacker supplies a knowledge-base query containing a single quote followed by shell syntax and an attacker-selected command.
- The skill places the query into the single-quoted
-dargument through direct placeholder s ...[truncated 1277 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not construct shell commands by substituting user questions or retrieved passages into command strings.
- Prefer a structured HTTP client or tool that accepts the URL, headers, and JSON body as separate typed parameters without invoking a shell.
- Serialize request bodies with a standard JSON library so quotation marks, backslashes, newlines, and control characters are escaped correctly.
- If shell execution is unavoidable, pass untrusted values through environment or positional-argument boundaries and generate the body with a safe serializer, such as:
bash payload="$(jq -n --arg query "$USER_QUERY" --argjson top_k 5 \ '{query: $query, top_k: $top_k}')" curl -sS -X POST "https://sdk.senso.ai/api/v1/search" \ -H "Content-Type: application/json" \ -H "X-API-Key: ${SENSO_API_KEY}" \ --data-binary "$payload" - Apply the same serialization controls to search-result passages sent to the generation endpoint.
- Do not use
eval, dynamically generated scripts, or nested shell expansion to execute the request. - Add tests containing single quotes, double quotes, command substitutions, shell separators, backslashes, and multiline input to verify that all values remain inert JSON data.
- Run the execution tool under least privilege with restricted filesystem and network access to limit impact if another injection defect is introduced.