T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:31
- Finding
- Command Injection Through Unsafe Hostname Interpolation in Shell Templates<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:31-35` and `SKILL.md:75-79` **Vulnerability Type**: Shell command injection through unescaped user-controlled input **Risk Level**: High ### Vulnerable Code Quick lookup template (`SKILL.md:31-35`): ```bash curl -s -X POST \ -H 'Content-Type: application/json' \ -d "{\"hostname\":\"HOSTNAME\",\"license\":\"$ALPHAMOUNTAIN_API_KEY\",\"version\":1,\"sections\":[\"threat\",\"category\",\"popularity\",\"dga\"]}" \ https://api.alphamountain.ai/intelligence/hostname ``` Options template (`SKILL.md:75-79`): ```bash curl -s -X POST \ -H 'Content-Type: application/json' \ -d "{\"hostname\":\"HOSTNAME\",\"license\":\"$ALPHAMOUNTAIN_API_KEY\",\"version\":1,\"sections\":[\"threat\",\"pdns\",\"relations_same_ip\"],\"options\":{\"pdns\":{\"limit\":20},\"relations_same_ip\":{\"limit\":10,\"flags\":[\"include-ratings\"]}}}" \ https://api.alphamountain.ai/intelligence/hostname ``` ### Technical Analysis The Skill instructs the Agent to extract a hostname from user-supplied input and insert it into a double-quoted shell argument. It does not require strict hostname validation, shell-safe argument handling, or structured JSON serialization. If an implementation performs direct textual replacement of `HOSTNAME`, shell syntax contained in the supplied value may be evaluated while the command is parsed. In particular, command substitutions such as `$()` or backticks remain active inside double-quoted shell strings. Quotes and backslashes can also alter the JSON or command structure. The documented request legitimately sends the configured `ALPHAMOUNTAIN_API_KEY` and requested hostname to `https://api.alphamountain.ai`. That network behavior is disclosed and necessary for the declared API-backed functionality. The vulnerability is not the intended API transmission itself, but the unsafe construction of the local shell command used to perform it. ### Attack Path 1. An attacker supplies a crafted hostn ...[truncated 1649 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Validate the hostname strictly** - Parse URLs using a dedicated URL parser rather than string replacement. - Accept only a valid DNS hostname or explicitly supported IP-address format. - Reject whitespace, control characters, quotes, backslashes, shell metacharacters, URL credentials, and unexpected ports. - Enforce reasonable length limits and valid label structure. 2. **Avoid direct textual substitution into shell commands** - Prefer an HTTP client or tool interface that accepts an argument array and a structured request object. - Do not construct a command string and pass it through `sh -c`, `bash -c`, `eval`, or an equivalent shell evaluator. 3. **Serialize JSON with a structured encoder** - Build the request body using a language-native JSON serializer. - If a shell example is necessary, generate JSON with a tool such as `jq` and pass the hostname as a separately quoted argument: ```bash payload="$(jq -n \ --arg hostname "$hostname" \ --arg license "$ALPHAMOUNTAIN_API_KEY" \ '{hostname: $hostname, license: $license, version: 1, sections: ["threat", "category", "popularity", "dga"]}')" curl -sS -X POST \ -H 'Content-Type: application/json' \ --data-binary "$payload" \ 'https://api.alphamountain.ai/intelligence/hostname' ``` 4. **Document the safe execution requirement** - Explicitly prohibit direct replacement of `HOSTNAME` in the sample command. - State that all user-provided domain and URL values are untrusted data. - Provide reference validation logic or a constrained hostname grammar. 5. **Limit secret exposure** - Keep `ALPHAMOUNTAIN_API_KEY` scoped only to the process performing the request. - Avoid logging command lines, payloads, or error output containing the license key. - Ensure requests are sent only to the fixed HTTPS alphaMountain endpoint. ]]>