T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:49- Finding
Potential Shell Command Injection Through User-Controlled Agent Name
- Content
View full analysis
` ``` ### Technical Analysis The skill instructs the agent to obtain an agent name from the user and place that value into a quoted CLI command. It does not require validation, shell escaping, or invocation through a structured argument array. Double quotes do not safely neutralize all shell syntax. If an implementation constructs a command string by replacing `Name` with the user-supplied value and then passes that string to a shell, an attacker can include a closing quote followed by shell metacharacters. This can terminate the intended argument and append an additional command. For example, a value conceptually shaped like the following could escape the quoted argument in a POSIX shell: ```text example"; attacker-controlled-command; # ``` The vulnerability is conditional on the runtime invoking the documented command through a shell. Executing the CLI directly with an argument array would prevent shell interpretation. ### Attack Path 1. An attacker asks the skill to create an ElevenLabs agent. 2. The skill requests the new agent's name and purpose. 3. The attacker supplies an agent name containing a closing quote and shell control operators. 4. The implementation substitutes that untrusted value into the documented command string. 5. The implementation executes the resulting string through a shell. 6. The shell interprets the injected syntax and runs the attacker's additional command with the privileges of th ...[truncated 780 chars]- Remediation
View remediation