T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:397- Finding
Arbitrary Command Execution Through an Untrusted Download Command and Shell eval
- Content
View full analysis
> nlm-poll.log 2>&1 || true ``` ### Technical Analysis The polling script reads `download_cmd` from `artifacts.json` and passes the resulting string to the shell through `eval`. Unlike direct execution with a fixed executable and argument array, `eval` reparses the assembled value as shell syntax. Consequently, shell operators, command substitutions, redirections, and additional commands embedded in `download_cmd` are interpreted and executed. The script also interpolates `NOTEBOOK_ID`, `ART_ID`, and `OUTPUT_FILE` into the evaluated command. Although these values are placed inside a quoted argument to `eval`, that quoting protects only the initial construction of the string; it does not provide safe argument boundaries when `eval` reparses the resulting command. `artifacts.json` is stored in the workflow's temporary task directory and is explicitly treated as writable workflow state. If an attacker can modify this file—particularly in conjunction with the predictable temporary-directory issue described separately—the attacker can replace the expected command with arbitrary shell syntax. ### Attack Path 1. A workflow is launched with artifact downloading enabled. 2. The script creates or consumes `artifacts.json` in the task directory. 3. An attacker with write access to that file changes an entry such as: ```json { "type": "audio", "id": "abc123", "download_cmd": "nlm download audio; attacker_command" } ``` 4. NotebookLM reports that the corresponding artifac ...[truncated 1001 chars]- Remediation
View remediation