T09 · Insecure Skill Coding Practices
Error
- Location
- README.md:39
- Finding
- Shell Command Injection Through Unsafe User Message Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 39–41 **Vulnerability Type**: Shell command injection in documented agent integration **Risk Level**: High ### Vulnerable Code ```bash python3 skills/arya-model-router/router.py --text "<user message>" --context-chars 65000 ``` ### Technical Analysis The documented integration instructs an agent to substitute an untrusted user message directly into a shell command enclosed by double quotes. Double quotes do not prevent shell command substitution: constructs such as `$(command)` and backticks are evaluated by the shell before `router.py` receives the value of `--text`. For example, if a user message contains `$(id)`, direct substitution produces: ```bash python3 skills/arya-model-router/router.py --text "$(id)" --context-chars 65000 ``` The shell executes `id` first and passes its output to the Python script. More harmful commands could be substituted in the same way. The Python implementation does not itself execute the message, but it cannot protect against expansion that already occurred in the invoking shell. ### Attack Path 1. An attacker submits a message containing shell substitution syntax, such as `$(malicious_command)`. 2. An integrating agent or application follows the documented command and inserts the message into the quoted `--text` argument. 3. The command is executed through a shell. 4. The shell evaluates the attacker-controlled substitution before starting Python. 5. The injected command runs with the permissions and environment of the integrating agent. 6. Only the resulting command output is supplied to `router.py`, potentially concealing the original injection from application-level processing. This path applies when the documented placeholder is implemented through string interpolation followed by shell execution. Invocation through a correctly constructed argument array is not vulnerable to this issue. ### Impact Assessment Successful exploitation provides ...[truncated 628 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Do not construct a shell command by interpolating the user message. Invoke the script with a structured argument array so no shell parses the message: ```python import subprocess subprocess.run( [ "python3", "skills/arya-model-router/router.py", "--text", user_message, "--context-chars", "65000", ], check=True, ) ``` Alternatively, redesign `router.py` to accept message content through standard input and pass it without shell interpolation. Update `README.md` to: 1. Warn that user-controlled messages must never be concatenated into a shell command. 2. Provide an argument-array integration example as the recommended method. 3. Avoid examples that imply double quoting is sufficient sanitization. 4. If a shell is unavoidable, pass data through a positional parameter rather than embedding it in command text; however, direct argument-array execution should remain the preferred approach. 5. Add a regression test using payloads containing `$(...)`, backticks, quotes, semicolons, and newlines to verify that they are delivered as literal text and never executed. ]]>