T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:254
- Finding
- Shell Command Injection Through the Mandatory Moderation Workflow<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:254-258` **Vulnerability Type**: Shell command injection caused by unsafe interpolation of generated content **Risk Level**: High ### Vulnerable Code ```bash echo "<your narrative text>" | python3 {baseDir}/scripts/moderation.py check - ``` The accompanying workflow requires the agent to replace the placeholder with generated narrative text before executing the command. ### Technical Analysis The generated narrative is influenced by player input and is inserted into a double-quoted shell argument. Double quotes do not prevent shell command substitution. Constructs such as `$(command)` and backticks are evaluated by the shell before `echo` sends the resulting text to the moderation process. Moderation therefore occurs too late to prevent exploitation: the shell interprets command-substitution syntax before `moderation.py` receives the text. Escaping ordinary quotation marks alone would also be insufficient unless all shell metacharacters were handled correctly. Although the underlying Python moderation CLI safely supports standard input, the Skill instructs the agent to construct the standard input through an unsafe shell command. ### Attack Path 1. A player supplies text containing a shell payload, such as an instruction designed to make the narrative reproduce `$(attacker_command)`. 2. The language model incorporates the payload into its generated narrative. 3. The agent replaces the placeholder in the documented `echo` command with that narrative. 4. The host shell parses the resulting command. 5. Command substitution executes before `moderation.py` starts processing the narrative. 6. The output of the injected command is passed to moderation, concealing the fact that execution has already occurred. ### Impact Assessment Successful exploitation permits arbitrary command execution with the operating-system privileges of the process running the agent or Skill. Depending on those privilege ...[truncated 510 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not interpolate narrative text into any shell command. - Invoke `moderation.py` through a structured process API with `shell=False`. - Pass the narrative through the child process's standard-input stream rather than through `echo`. - If the orchestration platform only supports command execution, write the content using a secure API and pass an already-open stream or a securely created temporary file. - Avoid attempting to solve this solely through shell escaping; eliminating shell interpretation is substantially safer. - Add regression tests containing command substitutions, backticks, quotes, newlines, redirections, pipes, and semicolons. - Update the documented workflow to use a tool-native stdin field, for example conceptually: ```python subprocess.run( ["python3", moderation_path, "check", "-"], input=narrative, text=True, shell=False, check=False, ) ``` ]]>