T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:35
- Finding
- Shell Command Injection Through Unquoted Trading Parameters## Vulnerability Details **File Location**: `SKILL.md`, lines 35–42 **Vulnerability Type**: Command injection through unsafe shell command construction **Risk Level**: High ### Vulnerable Code ```text python "{{KIS_TRADE_SCRIPT_PATH}}" price {{symbol}} ### execute_order 주식을 매수하거나 매도합니다. **반드시 사전에 사용자의 확답을 받으세요.** - `symbol` (string): 종목코드 - `qty` (number): 수량 - `price` (number): 주문 가격 - `side` (string): 'BUY' 또는 'SELL' **Command:** python "{{KIS_TRADE_SCRIPT_PATH}}" order {{symbol}} {{qty}} {{price}} {{side}} ``` ### Technical Analysis The `symbol`, `qty`, `price`, and `side` parameters are interpolated directly into command templates without shell-safe quoting. Although the documentation describes expected types and values, it does not define or enforce validation constraints. If the tool runner executes these templates through a shell, shell metacharacters contained in a parameter will be interpreted as command syntax rather than as a single argument. For example, a malicious `symbol` containing a command separator could terminate the intended argument and append another operating-system command. Quoting `KIS_TRADE_SCRIPT_PATH` does not protect the other interpolated parameters. The requirement to obtain user confirmation before an order also does not prevent injection through price lookups or through malicious values included in an approved order. ### Attack Path 1. An attacker causes crafted text to be supplied as `symbol`, `qty`, `price`, or `side`, directly or through untrusted content processed by the Agent. 2. The value includes shell syntax, such as a command separator followed by an operating-system command. 3. The value is substituted directly into the documented command template. 4. A shell-backed tool runner parses the injected syntax. 5. The intended Python invocation runs, fails, or is bypassed, while the appended attacker-controlled command executes with the privileges of the Agent process. A representative malicious `symbol` would ha ...[truncated 1054 chars]
- Remediation
- ## Remediation Suggestions 1. Do not execute interpolated command strings through a shell. Invoke Python with an argument-array API equivalent to: ```text ["python", KIS_TRADE_SCRIPT_PATH, "order", symbol, qty, price, side] ``` 2. Apply strict allowlist validation before invocation: - Require `symbol` to match `^[0-9]{6}$`. - Require `qty` to be a positive integer within an explicitly configured maximum. - Require `price` to be a positive numeric value within appropriate market and account limits. - Require `side` to equal exactly `BUY` or `SELL`. - Reject unexpected whitespace, control characters, shell metacharacters, and extra arguments. 3. Resolve and validate `KIS_TRADE_SCRIPT_PATH` against an administrator-controlled allowlisted path. Verify that it points to a regular file with trusted ownership and is not writable by untrusted users. 4. Preserve the existing explicit confirmation requirement, but display and confirm the normalized symbol, side, quantity, price, and estimated order value. Bind approval to those exact values and invalidate it if any value changes. 5. Run the trading process with least privilege, restrict its filesystem and network access, and expose brokerage credentials only to the process that requires them. 6. Add negative tests using command separators, substitutions, redirects, newlines, and argument-injection payloads to verify that malformed values are rejected and never interpreted by a shell.