T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:144- Finding
Command Injection Through Unsafe User-Query Interpolation in a Shell-Embedded Python Program
- Content
View full analysis
/raw_documents.json').read_text()) # Build the digest-safe view: strip tables[] and image paths, keep text + indices docs_view = [] for d in raw.get('documents', []): docs_view.append({ 'doc_index': d['doc_index'], 'type': d['type'], 'text': d.get('text',''), 'tables_count': len(d.get('tables') or []), 'images_count': len(d.get('inherited_images') or []), }) user_prompt = json.dumps({ 'user_query': '', 'documents': docs_view, }, ensure_ascii=False) sys_prompt = open('$SKILL_DIR/prompts/document_digest.md').read() out = llm(sys_prompt, user_prompt) # Parse JSON; if it fails, degrade digest to null (not abort entry) try: digest = json.loads(out) except Exception: digest = None pathlib.Path('/digest_tmp.json').write_text(json.dumps(digest, ensure_ascii=False)) " ``` ### Technical Analysis The documented command builds Python source code by directly substituting the original user query into a `python3 -c` program. The entire Python program is enclosed in shell double quotes. Shell expansion occurs before Python receives the source code. Consequently, shell constructs embedded in the user query—particularly command substitutions such as `$(command)` or backtick substitutions—can be executed by the shell even though the substitution point visually appears inside a single-quoted Python string. Python single quotes have no protective meaning to the outer shell. The query can also contain quotes, newlines, or Python syntax that terminates the intended string literal and modifies the generated Python program. ...[truncated 2246 chars]- Remediation
View remediation