T09 · Insecure Skill Coding Practices
Error
- Location
references/prompts.md:12- Finding
Shell Command Injection During Temporary Context File Creation
- Content
View full analysis
/tmp/rt_{topic}.md << 'DATA'\n{proposal_content}\nDATA") ``` The file-based workflow is also recommended in `SKILL.md:36-41`, making this template part of the Skill's documented execution path. ### Technical Analysis The command constructs a shell script by directly interpolating the untrusted `topic` and `proposal_content` values. The `proposal_content` value is inserted into a shell heredoc. An attacker can include a line containing only `DATA` to terminate the heredoc early and then append arbitrary shell commands. The `topic` value is interpolated into an unquoted pathname and may also introduce shell metacharacters, redirections, substitutions, or additional commands. Because the resulting string is passed to `exec`, injected content is interpreted as shell syntax rather than treated exclusively as file data. The fixed `/tmp/rt_{topic}.md` naming pattern also lacks safe temporary-file creation controls. ### Attack Path 1. An attacker submits a strategic proposal containing a standalone `DATA` line. 2. The attacker places a shell command after that line. 3. The Skill interpolates the proposal into the documented `exec` template. 4. The injected `DATA` line closes the intended heredoc. 5. The shell parses and executes the attacker's subsequent command. 6. The command runs with the same operating-system permissions as the hosting Agent. A malicious `topic` can provide another injection path if shell syntax is inserted into the unquoted temporary-file pathname. ### Impact Assessment Successful exploitation permits arbitrary command execution under the Agent process's account. Depending on that account's permissions, an attacker could: - Read files accessible to the Agent. - Modif ...[truncated 391 chars]- Remediation
View remediation