T09 · Insecure Skill Coding Practices
Error
- Location
README.md:39- Finding
Shell Command Injection Through Unsafe User Message Interpolation
- Content
View full analysis
" --context-chars 65000 ``` ### Technical Analysis The documented integration instructs an agent to substitute an untrusted user message directly into a shell command enclosed by double quotes. Double quotes do not prevent shell command substitution: constructs such as `$(command)` and backticks are evaluated by the shell before `router.py` receives the value of `--text`. For example, if a user message contains `$(id)`, direct substitution produces: ```bash python3 skills/arya-model-router/router.py --text "$(id)" --context-chars 65000 ``` The shell executes `id` first and passes its output to the Python script. More harmful commands could be substituted in the same way. The Python implementation does not itself execute the message, but it cannot protect against expansion that already occurred in the invoking shell. ### Attack Path 1. An attacker submits a message containing shell substitution syntax, such as `$(malicious_command)`. 2. An integrating agent or application follows the documented command and inserts the message into the quoted `--text` argument. 3. The command is executed through a shell. 4. The shell evaluates the attacker-controlled substitution before starting Python. 5. The injected command runs with the permissions and environment of the integrating agent. 6. Only the resulting command output is supplied to `router.py`, potentially concealing the original injection from application-level processing. This path applies when the documented placeholder is implemented through string interpolation followed by shell execution. Invocation through a correctly constructed argument array is not vulnerable to this issue. ### Impact Assessment Successful exploitation provides ...[truncated 628 chars]- Remediation
View remediation