T09 · Insecure Skill Coding Practices
Error
- Location
scripts/oktk.js:132- Finding
Shell Injection and Duplicate Command Execution in the Command Wrapper
- Content
View full analysis
&1 | oktk "git $*" } ``` `scripts/oktk-aliases.sh:42-52`: ```bash # Full docker wrapper function dk() { docker "$@" 2>&1 | oktk "docker $*" } dkc() { docker-compose "$@" 2>&1 | oktk "docker-compose $*" } ``` `scripts/oktk-aliases.sh:58-60`: ```bash # Full kubectl wrapper function kk() { kubectl "$@" 2>&1 | oktk "kubectl $*" } ``` `scripts/oktk-aliases.sh:85-87`: ```bash ok() { "$@" 2>&1 | oktk "$*" } ``` ### Technical Analysis The CLI converts structured process arguments back into a single command string using `args.join(' ')`. It then supplies that string to `child_process.execSync()`, which executes the command through a system shell. The shell wrappers compound the problem by converting their structured argument arrays into command text using `$*`. Quoting information and argument boundaries are lost during this conversion. Shell metacharacters that were originally contained inside a literal argument can therefore become active shell syntax when `oktk` executes the reconstructed string. Potentially dangerous syntax includes: - Command substitution: `$(...)` and backticks - Command separators: `;` and ...[truncated 2737 chars]- Remediation
View remediation
&1 | oktk "$*" ``` with a stdin mode that does not execute the supplied metadata: ```bash "$@" 2>&1 | oktk --stdin --type generic ``` 6. **Add regression tests** - Verify that literal arguments containing `;`, `&&`, `|`, `>`, `$()`, backticks, spaces, quotes, and newlines remain literal. - Verify that every wrapper executes its target exactly once. - Verify that stdin-filtering mode never invokes `child_process`. ]]>