T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:32
- Finding
- Shell Command Injection Through Unquoted Placeholders## Vulnerability Details **File Location**: `SKILL.md`, lines 32–37 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```markdown **Required evidence (use tools to retrieve):** - Logs: `exec("grep -i 'error\|fatal\|exception' {logfile} | tail -50")` - Git state: `exec("git log --oneline -10")`, `exec("git diff HEAD~1 --stat")` - Service state: `exec("systemctl status {service}")`, `exec("ps aux | grep {process}")` - Data files: `read` any CSVs, configs, or state files involved ``` ### Technical Analysis The skill instructs the agent to place variable values such as `{logfile}`, `{service}`, and `{process}` directly into shell command strings. It does not require shell escaping, strict input validation, allowlisting, or argument-array execution. If any substituted value is influenced by an untrusted incident report, filename, service name, or process identifier, shell metacharacters such as `;`, `&&`, command substitutions, redirections, or newlines may be interpreted as additional shell operations. The piped `grep` command is especially exposed because `{logfile}` is unquoted. The Git commands shown here contain no variable substitutions and are not themselves the vulnerable portion, but they appear in the complete surrounding evidence-gathering block. ### Attack Path 1. An attacker creates or identifies an incident artifact with a crafted filename, or supplies a malicious service or process value. 2. The user requests an incident review involving that attacker-influenced value. 3. Following the skill, the agent substitutes the value into one of the documented `exec(...)` command strings. 4. The shell interprets embedded metacharacters rather than treating the full value as one inert argument. 5. The injected command runs with the same operating-system privileges and environment access as the agent's execution tool. ### Impact Assessment Successful exploitation could execute arbitrary commands under the agent's a ...[truncated 362 chars]
- Remediation
- ## Remediation Suggestions - Replace shell command strings with structured process execution using fixed executables and argument arrays. - Canonicalize file paths and restrict evidence access to explicitly approved roots. - Validate service and process identifiers with strict allowlists, such as a narrowly defined character set and maximum length. - Do not use `grep` through a shell for attacker-influenced paths; pass the path as a discrete argument and use an end-of-options marker where supported. - If a shell is unavoidable, apply robust shell-specific quoting and reject all unexpected metacharacters before execution. - Require the agent to display the resolved command and obtain approval before executing commands derived from untrusted incident input. - Add automated tests covering filenames and identifiers containing spaces, option prefixes, semicolons, substitutions, redirections, and newlines.