T09 · Insecure Skill Coding Practices
Error
- Location
- src/platform/linux.js:30
- Finding
- Shell Command Injection in the Linux Calculator Module<![CDATA[ ## Vulnerability Details **File Location**: `src/platform/linux.js`, lines 30–41 **Vulnerability Type**: OS command injection through unvalidated shell interpolation **Risk Level**: High ### Vulnerable Code ```javascript async function typeNumber(number) { if (!number) { throw new Error('Number parameter is required'); } try { // Use --solve flag to directly display the number // This works without xdotool! await execAsync(`gnome-calculator -s ${number} &`, { stdio: 'ignore' }); console.log(`Displayed ${number} on calculator`); } catch (error) { ``` ### Technical Analysis The exported `typeNumber()` function interpolates `number` directly into a command string passed to `child_process.exec()`. The `exec` API invokes a system shell, so shell metacharacters contained in `number` are interpreted as command syntax rather than calculator data. The function only checks whether `number` is nonempty. It does not enforce the documented numeric-expression character set, escape shell metacharacters, or separate the executable from its arguments. Although the current `src/index.js` entry point does not import this platform module, the function is exported and can be invoked by another package component or consumer. Consequently, this is an exploitable API boundary if caller-controlled input reaches it. ### Attack Path 1. An application imports `src/platform/linux.js`. 2. The application passes user-controlled calculator content to `typeNumber()`. 3. The attacker includes shell separators or substitution syntax in the supplied value. 4. The resulting string is passed to `execAsync()`. 5. The system shell parses the injected syntax and executes additional commands with the privileges of the Node.js process. ### Impact Assessment Successful exploitation permits arbitrary command execution as the account running the skill or host agent. This can enable reading or modifying accessible files, launching processes, accessing locall ...[truncated 155 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace `exec()` with `spawn()` or `execFile()` and pass arguments as a separate array. - Enforce a strict allowlist at the exported function boundary, such as `^[0-9+\-*/.() ]{1,100}$`. - Reject unexpected input rather than attempting shell escaping. - Do not use `&` for detachment; use the process API's `detached` and `stdio` options. Example: ```javascript const { spawn } = require('child_process'); function typeNumber(number) { const value = String(number); if (!/^[0-9+\-*/.() ]{1,100}$/.test(value)) { throw new Error('Invalid calculator expression'); } const child = spawn('gnome-calculator', ['-s', value], { detached: true, stdio: 'ignore', shell: false }); child.unref(); } ``` ]]>