T09 · Insecure Skill Coding Practices
- Location
SKILL.md:23- Finding
User-Controlled Search Keyword Is Interpolated into a Shell Command
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 23-26
Vulnerability Type: OS command injection
Risk Level: HighVulnerable Code:
markdown - Input: keyword (string) from UserInput - Action: Run Python script - Command: python C:\Users\Admin\OneDrive\Desktop\LearnOpCL\bot.py "{keyword}" - Working directory: C:\Users\Admin\OneDrive\Desktop\LearnOpCLTechnical Analysis
The Skill directs the workflow to interpolate the user-controlled
keyworddirectly into a command string. Enclosing the value in double quotation marks does not provide reliable command-injection protection. If the workflow executes this string through a command shell, a malicious keyword can close the quoted argument and introduce shell operators or additional commands.The documentation does not require validation, escaping, an allowlist, or use of a process API that passes arguments without shell interpretation. Consequently, the safety of command execution depends on unspecified workflow behavior.
Attack Path
- An attacker submits a search keyword containing a closing quotation mark and shell metacharacters appropriate to the Windows command interpreter used by the workflow.
- The workflow replaces
{keyword}with the attacker-controlled text. - The resulting command is passed to a shell rather than executed through a structured argument array.
- The shell treats the injected operators as command syntax.
- The injected command executes with the permissions of the workflow or agent account.
Exploitation is contingent on the workflow using shell-based execution, but the documented command construction is unsafe and does not prohibit that execution mode.
Impact Assessment
Successful exploitation could provide arbitrary command execution under the workflow account. The attacker could access files available to that account, alter local data, invoke installed programs, make outbound network con ...[truncated 152 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not construct a shell command by concatenating or interpolating the search keyword.
- Invoke Python through a process API with shell execution disabled and pass each argument separately, such as an argument array containing the interpreter, script path, and keyword.
- Validate the keyword against documented length and character constraints before execution.
- Avoid relying on quoting or ad hoc escaping as the primary defense.
- Run the search component under a restricted account with only the filesystem and network permissions required for searching.
- Add tests covering quotation marks, command separators, variable expansion, newlines, and other shell metacharacters.