T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:73
- Finding
- Command Injection Through Unquoted User-Controlled File Paths<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:73-76` **Vulnerability Type**: Shell command injection caused by unsafe path interpolation **Risk Level**: High ### Vulnerable Code ```bash # Write content to the user file and record a snapshot using its absolute path. mkdir -p ~/.writing-style-iterator/drafts/$(dirname <ABSOLUTE_USER_FILE_PATH>) && cp <USER_FILE> ~/.writing-style-iterator/drafts/<ABSOLUTE_USER_FILE_PATH> && git -C ~/.writing-style-iterator add . && git -C ~/.writing-style-iterator commit -m "draft: <FILE_NAME>" ``` ### Technical Analysis The command template inserts a user file path and filename directly into shell syntax without quoting or separating the values from the command. The path is used inside command substitution, as a `cp` argument, as part of a destination path, and in a Git commit message. If an agent replaces these placeholders with an untrusted path and submits the resulting string to a shell, spaces and shell metacharacters can change the command's meaning. Characters such as semicolons, redirections, command substitutions, and option prefixes can produce additional commands or alter the behavior of `dirname`, `cp`, or `git`. Using `&&` does not provide atomicity and does not prevent injection. It only controls whether the following command runs based on the preceding command's exit status. ### Attack Path 1. An attacker supplies, creates, or induces the use of a crafted output filename or absolute path. 2. The agent substitutes the path into the documented command template. 3. The agent executes the constructed command through a shell. 4. The shell interprets metacharacters embedded in the path as syntax rather than as literal filename characters. 5. Attacker-selected commands execute with the same operating-system privileges as the agent process. For example, a path containing a shell command separator could terminate the intended `cp` argument and append another command when the agent builds a raw sh ...[truncated 686 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Prefer a structured file-operation API rather than constructing shell command strings. - Pass paths as separate process arguments without invoking a shell. - If shell use is unavoidable, place every expanded path in double quotes and prevent the value from being parsed as shell source. - Use `--` before path arguments where supported to prevent filenames beginning with `-` from being interpreted as options. - Validate that source files reside inside an explicitly approved workspace. - Reject paths containing control characters and normalize paths before use. - Generate snapshot identifiers independently instead of embedding an absolute path directly into a command. - Avoid inserting untrusted filenames into Git commit messages through generated shell syntax. - Do not describe an `&&` chain as atomic; implement explicit error handling and cleanup or use transactional file operations. ]]>