T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:58- Finding
Unsafe URL Interpolation Enables Command Injection and Internal Resource Access
- Content
View full analysis
" | python3 -c " import sys, re html = sys.stdin.read() # Strip tags, get text text = re.sub('<[^>]+>', ' ', html) text = re.sub(r'\s+', ' ', text).strip() print(text[:5000]) " ``` ### Technical Analysis The workflow instructs the agent to substitute a URL obtained from research results into a shell command. No validation, escaping mechanism, protocol allowlist, destination filtering, or argument-safe process invocation is specified. If the agent performs literal textual substitution, a URL containing shell metacharacters or quotation marks could escape the quoted argument and introduce additional shell commands. Execution would occur with the privileges of the account running the agent. The command also uses `curl -L`, which follows redirects without requiring each destination to be revalidated. An attacker-controlled public URL could redirect the request to localhost, a private network address, a link-local service, or a cloud metadata endpoint. Retrieved content would then enter the agent's context and could be exposed through the generated report. The command does **not** directly pipe downloaded code to Bash. Its response body is passed to a fixed Python text extraction program, so the pre-scan's characterization as direct remote payload execution is not supported. The risk instead arises from unsafe command construction and unrestricted outbound retrieval. ### Attack Path 1. An attacker supplies a crafted research URL or causes it to appear in search results. 2. The agent selects that URL for the documented deep-read operation. 3. The agent inserts the URL into the shell command without robust argument handling. 4. Either: - shell syntax embedded in the substituted value escapes the quoted argument and executes commands under the ...[truncated 1109 chars]- Remediation
View remediation