T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:254- Finding
Shell Command Injection Through the Mandatory Moderation Workflow
- Content
View full analysis
" | python3 {baseDir}/scripts/moderation.py check - ``` The accompanying workflow requires the agent to replace the placeholder with generated narrative text before executing the command. ### Technical Analysis The generated narrative is influenced by player input and is inserted into a double-quoted shell argument. Double quotes do not prevent shell command substitution. Constructs such as `$(command)` and backticks are evaluated by the shell before `echo` sends the resulting text to the moderation process. Moderation therefore occurs too late to prevent exploitation: the shell interprets command-substitution syntax before `moderation.py` receives the text. Escaping ordinary quotation marks alone would also be insufficient unless all shell metacharacters were handled correctly. Although the underlying Python moderation CLI safely supports standard input, the Skill instructs the agent to construct the standard input through an unsafe shell command. ### Attack Path 1. A player supplies text containing a shell payload, such as an instruction designed to make the narrative reproduce `$(attacker_command)`. 2. The language model incorporates the payload into its generated narrative. 3. The agent replaces the placeholder in the documented `echo` command with that narrative. 4. The host shell parses the resulting command. 5. Command substitution executes before `moderation.py` starts processing the narrative. 6. The output of the injected command is passed to moderation, concealing the fact that execution has already occurred. ### Impact Assessment Successful exploitation permits arbitrary command execution with the operating-system privileges of the process running the agent or Skill. Depending on those privilege ...[truncated 510 chars]- Remediation
View remediation