T09 · Insecure Skill Coding Practices
- Location
SKILL.md:55- Finding
Shell Command Injection Through Unescaped Reminder Parameters
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 55–60
Vulnerability Type: Shell command injection through unsafe command construction
Risk Level: HighVulnerable Code
json { "tool": "exec", "command": "bash {baseDir}/scripts/remind.sh \"<when>\" \"<text>\"" }Technical Analysis
The documented execution workflow inserts the user-derived
whenandtextvalues directly into a shell command string. Placing these values inside double quotes does not safely escape embedded quotation marks, command substitutions, backticks, or other shell syntax.For example, crafted reminder text conceptually shaped like the following can terminate the quoted argument and append another command:
text legitimate reminder"; id; #This would produce a command equivalent to:
bash bash {baseDir}/scripts/remind.sh "20m" "legitimate reminder"; id; #"The shell executes the injected command separately from
remind.sh. Althoughscripts/remind.shcorrectly quotes the arguments it receives, that protection applies only after shell parsing. It therefore cannot prevent injection occurring while the outer command string is being constructed and parsed.The confirmation step reduces accidental execution but does not neutralize malicious shell syntax. A user may confirm crafted input without being shown the exact shell representation, and reminder content could also originate from untrusted text processed by the Agent.
Attack Path
- An attacker supplies reminder text or a time value containing an embedded quotation mark and shell syntax.
- The Agent parses the attacker-controlled value and asks for confirmation.
- The reminder request is confirmed.
- The Agent substitutes the value into the
execcommand template. - The shell interprets the injected syntax before
remind.shstarts. - The attacker-supplied command executes with the same operating-sy ...[truncated 902 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace the shell command string with a structured process invocation that accepts an argument array, ensuring
whenandtextare passed as literal arguments without shell interpretation. Conceptually:text executable: bash arguments: - {baseDir}/scripts/remind.sh - <when> - <text> -
If the execution interface cannot avoid a shell, do not interpolate reminder text directly. Transfer it through standard input or encode it using a non-executable representation such as Base64, then decode it inside the script.
-
Apply strict allowlist validation to
when. Relative durations should match a constrained expression such as digits followed by an approved unit. Absolute values should be parsed and regenerated as valid ISO 8601 timestamps rather than passed through verbatim. -
Treat reminder text as arbitrary data. Do not attempt to secure it using double quotes alone. If shell construction is unavoidable, use a well-tested shell-escaping routine that produces one safe argument rather than manually replacing selected characters.
-
Display the normalized reminder values during confirmation and reject control characters, embedded newlines, or unexpected binary data.
-
Add regression tests using payloads containing quotation marks, semicolons, command substitution syntax, backticks, newlines, and shell redirection. Verify that every payload reaches
remind.shas one literal argument and that no secondary command executes.
-