T09 · Insecure Skill Coding Practices
Error
- Location
中 N 个问题： 1. 第 X 行：<current code> → <fixed code> 2. 第 Y 行：<current code> → <fixed code> 修复后运行：<verify command> 确认无错误后 git commit -m '<message>'。" ``` ### Technical Analysis The documented command templates interpolate the project path and task-controlled strings into a shell command. The project path is not quoted, while the prompt, task, and commit message are enclosed in single quotes without any escaping procedure. Single quotes do not provide protection when the interpolated value itself can contain a ...[truncated 2310 chars]:24- Finding
Shell Command Injection Through Unescaped Dynamic Placeholders
- Content
View full analysis
&& cursor agent -p --trust [FLAGS] --model auto --workspace . ''", pty: true, timeout: ) ``` The same unsafe construction appears in the direct execution workflow: ```text exec( command: "cd && cursor agent -p --trust --yolo --model auto --workspace . ''", pty: true, timeout: 180 ) ``` A commit-message template also performs unsafe shell interpolation: ```text Execute: "修复 中 N 个问题： 1. 第 X 行： → 2. 第 Y 行： → 修复后运行： 确认无错误后 git commit -m ''。" ``` ### Technical Analysis The documented command templates interpolate the project path and task-controlled strings into a shell command. The project path is not quoted, while the prompt, task, and commit message are enclosed in single quotes without any escaping procedure. Single quotes do not provide protection when the interpolated value itself can contain a single quote. A value containing `'` can terminate the intended argument and introduce shell operators such as `;`, `&&`, command substitution, or redirection. An unquoted project path can likewise alter command parsing through spaces or shell metacharacters. For example, if a task placeholder were populated with a value conceptually equivalent to: ```text legitimate task'; attacker_command; # ``` the generated command would end the quoted task argument and execute `attacker_command` in the dispatcher's shell context. The audit did not execute such a payload; this path follows directly from the documented string-concatenation pattern. The risk also applies to `` because the instructions encourage inserting and running an arbitrary verification command w ...[truncated 1418 chars]- Remediation
View remediation
&& ...`. 3. If shell execution is unavoidable, apply platform-correct shell escaping independently to every dynamic argument. Generic quote replacement is not sufficient across shells. 4. Validate project paths using canonicalization and restrict them to an explicitly approved workspace root. 5. Treat task text, commit messages, repository content, and agent-produced verification instructions as untrusted input. 6. Replace arbitrary verification commands with a repository-specific allowlist of executable and argument combinations. 7. Pass Git commit messages as discrete arguments rather than interpolating them into a shell command. 8. Add tests containing quotes, spaces, newlines, command substitutions, redirections, and shell operators to ensure values remain single inert arguments. ]]>