T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:178- Finding
Shell Command Injection Through Unescaped Prompt and Branch Interpolation
- Content
View full analysis
Project Key: Branch Name: User Objective: Execution Requirements: 1) Work only inside . 2) Complete the requested work. 3) Use branch for commits/pushes when provided. 4) After completion, return a short completion summary. ``` ```bash bash pty:true workdir: command:"claude --dangerously-skip-permissions ''" ``` ```bash bash pty:true workdir: command:"codex exec --dangerously-bypass-approvals-and-sandbox ''" ``` ```bash bash pty:true workdir: command:"GEMINI_SANDBOX=false gemini -p ''" ``` ### Technical Analysis The skill inserts the user-controlled objective and partially user-controlled branch name into ``, then embeds that prompt inside a single-quoted shell argument. It does not specify any escaping or argument-safe process execution. A single quote in the objective can terminate the shell argument. Subsequent text is then interpreted by the shell rather than passed to the coding agent. The same general risk affects other interpolated values, including branch names and paths, where placeholders are inserted into shell command strings without robust quoting. The branch-name checks only reject `..`, a leading slash, and an empty value. They do not constitute shell metacharacter validation and are not a substitute for avoiding shell interpolation. This issue is especially severe because all documented engine invocations disable their respective permission or sandbox controls. ### Attack Path 1. An attacker supplies a PREQSTATION task whose objective contains a quote followed by shell syntax, for example: ```text preq: update documentation'; id > /tmp/preqstation-proof; # ``` 2. The ski ...[truncated 1288 chars]- Remediation
View remediation