T09 · Insecure Skill Coding Practices
Error
- Location
src/adapters/skill_search.ts:15- Finding
Shell Command Injection Through Paper-Derived Claims
- Content
View full analysis
0) { console.warn("SkillSearchAdapter stderr:", stderr); } ``` The vulnerable `claim` originates from paper content and is passed to this adapter by `DevilsAdvocateAgent` in `src/agents.ts:20-30`. ### Technical Analysis The adapter constructs a shell command by interpolating a paper-derived claim into a string passed to Node.js `child_process.exec()`. Because `exec()` invokes a command shell, shell metacharacters and command-substitution expressions in the claim may be interpreted by that shell. Replacing double quotes with `\"` is not sufficient shell escaping. For example, command substitutions using `$(...)` or backticks can still be evaluated inside double-quoted shell arguments. The deconstruction prompt instructs the LLM to quote rather than paraphrase source content, so malicious syntax embedded in a paper may be preserved in the generated claim. Although LLM transformation makes exact preservation nondeterministic, the adapter must treat all claim values as untrusted. ### Attack Path 1. An attacker supplies a paper or raw claim containing shell substitution syntax such as `$(command)`. 2. `DeconstructionAgent` sends the document to the LLM and obtains a logic graph containing the malicious text as a claim. 3. `DevilsAdvocateAgent.attack()` passes the claim to `SkillSearchAdapter.findContradictions()`. 4. `SkillSearchAdapter` interpolates the claim into a shell command. 5. `exec()` launches a shell, which can evaluate the injected substitution. 6. The injected command executes with the privileges of the Node.js process. In standalone mode, this path is selected wh ...[truncated 599 chars]- Remediation
View remediation