T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:76
- Finding
- Shell Command Injection Through Unquoted Task Name<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 76–78; mirrored in `SKILL_cn.md`, lines 75–77 **Vulnerability Type**: Shell command injection caused by unsafe variable interpolation **Risk Level**: High ### Vulnerable Code ```bash cd mosp-for-chatMOSP python3 utils/msr.py --json OUTPUT/{task_name}/input.json --output OUTPUT/{task_name}/ cd - ``` The same unquoted placeholder is subsequently used when accessing and processing generated files: ```bash ls -lh OUTPUT/{task_name}/ini.xyz ls -lh OUTPUT/{task_name}/{task_name}_cluster.xyz ``` ### Technical Analysis The instructions interpolate `{task_name}` directly into shell commands without quoting, canonicalizing, or validating it. The document does not require `{task_name}` to match a restricted character set. If the task name can be derived from user-controlled input, an attacker may include shell metacharacters such as semicolons, command substitutions, redirection operators, or whitespace. When the resulting command is executed through a shell, those characters can alter command structure and cause additional commands to run. Path traversal sequences such as `../` may also cause commands to read from or write to locations outside the intended `OUTPUT` directory. Quoting alone would prevent shell token injection but would not prevent traversal, so both validation and containment checks are necessary. ### Attack Path 1. An attacker supplies or influences a task name containing a shell payload, such as a semicolon followed by an arbitrary command. 2. The task name passes through the parameter-builder or file-organizer workflow because this Skill defines no strict validation requirement. 3. The Agent substitutes the value into the documented `python3`, `ls`, or visualization command. 4. A shell parses the injected metacharacters as command syntax. 5. The injected command executes with the same operating-system identity and permissions as the Agent. 6. Alternatively, a task name con ...[truncated 712 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict task names to a conservative allowlist before any filesystem or process operation: ```python if not re.fullmatch(r"[A-Za-z0-9._-]+", task_name): raise ValueError("Invalid task name") ``` 2. Reject path separators, traversal components, control characters, whitespace, and shell metacharacters. 3. Build paths with a filesystem API such as `pathlib.Path`, resolve them, and verify that every resolved path remains under the intended `OUTPUT` directory. 4. Execute Python programs through an argument-array API such as `subprocess.run([...], shell=False, check=True)` rather than constructing shell command strings. 5. If shell execution cannot be avoided, quote every expansion; however, do not treat quoting as a substitute for path validation and containment checks. 6. Apply the same protections to MSR generation, output validation, visualization, and Feishu attachment paths. 7. Add negative tests covering values containing `../`, spaces, semicolons, command substitutions, newlines, absolute paths, and symbolic-link escapes. 8. Update both language versions of the Skill so their security requirements remain consistent. ]]>