T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:27- Finding
Command Injection Through Untrusted URL Interpolation
- Content
View full analysis
" } ``` ```json { "tool": "exec", "command": "summarize \"\" --length short" } ``` ```json { "tool": "exec", "command": "python3 -c \"\nimport urllib.request, sys\nreq = urllib.request.Request('', headers={'User-Agent': 'Mozilla/5.0'})\nwith urllib.request.urlopen(req, timeout=10) as r:\n html = r.read().decode('utf-8', errors='ignore')\nimport re\ntitle = re.search(r'(.*?)', html, re.I)\nprint(title.group(1).strip() if title else '')\n\"" } ``` ### Technical Analysis The workflow instructs the agent to interpolate attacker-controlled URL values directly into shell command strings. The `xurl` command uses an entirely unquoted URL placeholder. Shell metacharacters in the supplied value can therefore terminate the intended argument and introduce additional commands. The `summarize` command places the URL inside double quotes, but does not escape embedded double quotes, command substitutions, backticks, or other shell-significant content. Quoting the placeholder in this manner does not provide safe argument separation. The Python fallback is exposed to two nested injection contexts: 1. The URL is inserted into Python source inside a single-quoted string. 2. The generated Python program is itself inserted into a shell command enclosed in double quotes. A crafted value can break out of either context and alter the executed Python program or shell command. No strict URL parser, character validation, argument-array execution mechanism, or shell bypass is specified. ### Attack Path 1. An attacker sends the agent a crafted Twitter, LinkedIn, or direct URL. 2. The skill classifies the input and substitutes the attacker-controlled value into one of the documented `exec` command ...[truncated 1519 chars]- Remediation
View remediation