T09 · Insecure Skill Coding Practices
Error
- Location
scripts/render_kitchen_instructions.py:92- Finding
Shell Command Injection in Generated Kitchen Bootstrap Instructions
- Content
View full analysis
") name = integ.get("name", "Integration") lines.append(f'npx poke@latest mcp add {url} -n "{name}"') lines.append("```") ``` ### Technical Analysis The script reads integration data from a user-selected recipe JSON file and interpolates the `url` and `name` fields directly into a Bash command. Neither field is validated or safely quoted. The `url` is emitted completely unquoted. Consequently, shell operators such as `;`, `&&`, `||`, command substitutions, redirections, and pipes remain active when a user copies and runs the generated command. Although `name` is placed inside double quotes, an attacker can insert a double quote followed by shell syntax to escape the intended argument. The renderer itself does not execute the command, so exploitation requires a user or automation process to execute the generated Kitchen instructions. However, the output explicitly presents the content as a copyable Bash bootstrap block, making command execution an intended downstream action. ### Attack Path 1. An attacker creates or modifies a recipe JSON file containing a malicious integration value, for example: ```json { "name": "Example", "integrations": { "required": [ { "name": "Example MCP", "url": "https://example.test/mcp; attacker-command" } ] } } ``` 2. The victim renders the file: ```bash python3 scripts/render_kitchen_instructions.py \ --recipe malicious-recipe.json \ --out kitchen-instructions.md ``` 3. The generated Markdown contains: ```bash npx poke@latest mcp ...[truncated 1072 chars]- Remediation
View remediation
", "mcp", "add", validated_url, "-n", name, ] lines.append(" ".join(shlex.quote(arg) for arg in command)) ``` 3. Reject newline and control-character injection in all fields written to command blocks. 4. Prefer a structured invocation mechanism that passes arguments as an array without a shell when commands are executed programmatically. 5. Clearly mark generated commands as derived from untrusted recipe content and require review before execution. 6. Add regression tests covering semicolons, quotes, command substitutions, pipes, redirections, newlines, and leading option characters in both `url` and `name`. ]]>