T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:91- Finding
Command Injection Through Unsafe JSON Construction in Shell
- Content
View full analysis
", "stream": false, "voice_setting": { "voice_id": "" }, "audio_setting": { "format": "mp3" }, "dictionary": }' -o response.json ``` ### Technical Analysis The command places the entire JSON request body inside a single-quoted shell argument while instructing the Agent to replace ``, ``, and `` with dynamically supplied values. The text and dictionary content can originate from user-provided TTS text. If these placeholders are replaced by direct textual substitution, a single quote in an untrusted value terminates the shell's quoted `-d` argument. Subsequent shell metacharacters can then be interpreted as commands rather than request data. Even without command execution, unescaped double quotes, backslashes, control characters, or newlines can corrupt the JSON structure or alter request fields. The API key is passed through an authorization header and is not hardcoded. However, successful command injection would execute with the privileges and environment of the Agent running the Skill, potentially exposing that credential and other accessible data. ### Attack Path 1. An attacker provides TTS text, a voice ID, or dictionary content containing a single quote followed by shell syntax. 2. The Skill workflow constructs the command by substituting that content directly into the single-quoted JSON literal. 3. The attacker-controlled single quote closes the `-d` shell argument prematurely. 4. The shell parses the remaining attacker-controlled ...[truncated 1321 chars]- Remediation
View remediation
"$request_file" curl --fail-with-body --silent --show-error \ -X POST "https://api.senseaudio.cn/v1/t2a_v2" \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ --data-binary "@$request_file" \ -o "$response_file" jq -e '.base_resp.status_code == 0 and (.data.audio | type == "string")' \ "$response_file" >/dev/null ``` This approach keeps untrusted values as JSON data and prevents the shell from interpreting their contents as executable syntax. ]]>