T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:79
- Finding
- Insufficient Shell Escaping for User-Controlled 1Password Arguments## Vulnerability Details **File Location**: `SKILL.md`, line 79 **Vulnerability Type**: Shell command injection caused by incomplete argument escaping **Risk Level**: High ### Vulnerable Code Snippet ```markdown - Always single-quote user-provided values in `op` command arguments (vault names, item names, field labels) — unquoted shell metacharacters in item names could execute arbitrary commands. ``` ### Technical Analysis The instruction requires user-provided vault names, item names, and field labels to be surrounded with single quotes. Although this blocks ordinary expansion of shell metacharacters, it is not sufficient when the input itself contains a single-quote character. If an agent constructs a shell command by directly interpolating a value as `'USER_INPUT'`, an embedded single quote terminates the quoted argument. The remaining input can then introduce shell operators and arbitrary commands. For example, directly interpolating the following item name: ```text example'; id; echo ' ``` could produce shell text equivalent to: ```bash op item get 'example'; id; echo '' ``` The shell interprets this as multiple commands rather than one literal item name. The problem is the prescribed textual quoting strategy, not the `op` CLI itself. Safe handling requires argument-vector execution or escaping every embedded single quote correctly. ### Attack Path 1. An attacker supplies or causes the agent to process a vault, item, or field name containing a single quote and shell control operators. 2. Following the skill instruction, the agent places single quotes around the value without escaping embedded single quotes. 3. The attacker-controlled quote closes the intended shell argument. 4. Shell separators in the remaining value introduce an additional command. 5. The shell executes the injected command with the privileges and environment of the agent process. Successful exploitation depends on the agent constructing and executing shell command text throu ...[truncated 717 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the single-quoting rule with a requirement to avoid constructing shell commands through string interpolation. 2. Pass every user-controlled value as a distinct argument through a structured argument vector or execution API that does not invoke a shell. 3. If shell command text is unavoidable, apply a proven POSIX shell-escaping routine that correctly transforms embedded single quotes, rather than merely surrounding input with quote characters. 4. Do not rely on double quotes as a substitute because they still permit forms of shell expansion. 5. Validate account, vault, item, and field identifiers where practical, while treating validation as defense in depth rather than a replacement for safe argument passing. 6. Add adversarial tests covering apostrophes, semicolons, command substitutions, newlines, redirection operators, and option-like values beginning with `-`. 7. Update the guardrail to state explicitly: ```markdown Never interpolate user-provided values into shell command strings. Pass vault, item, field, and account values as separate argv elements. If a shell command must be generated, use a proven shell-escaping function that safely handles embedded single quotes. ```