T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:111- Finding
Shell Command Injection Through an Unquoted User-Controlled Document Path
- Content
View full analysis
.bak && cp .bak/.md ``` ### Technical Analysis The canonical document path is selected or supplied by the user and is substituted directly into a shell command. The instructions do not require shell-safe quoting, option termination, validation, or use of a filesystem API. If an agent follows this command template literally, shell metacharacters in the document path can be interpreted as command syntax rather than as part of a filename. Relevant metacharacters include semicolons, command substitutions, redirection operators, pipes, and newlines. Paths beginning with a hyphen could also be interpreted as command-line options. For example, a maliciously supplied path shaped like the following could introduce an additional command when interpolated: ```text todo.md; attacker-command; # ``` Although the command is expected to execute in a sandbox, it still runs with all permissions and access granted to the agent's code-execution environment. ### Attack Path 1. An attacker convinces the user or agent to use a crafted canonical document path containing shell syntax. 2. The agent replaces `` with the crafted value in the documented snapshot command. 3. The agent invokes the resulting command through a shell. 4. The shell executes the injected syntax in addition to `mkdir` or `cp`. 5. The injected command can access, modify, or disclose resources available to the sandbox process. ### Impact Assessment Successful exploitation allows arbitrary command execution with the privileges of the agent's execution environment. Depending on the sandbox configuration, this could permit: - Reading other files available to the process. - Modifying or deleting the canoni ...[truncated 444 chars]- Remediation
View remediation