T09 · Insecure Skill Coding Practices
Error
- Location
- README.md:39
- Finding
- Shell Command Injection Through Documented User-Message Interpolation## Vulnerability Details **File Location**: `README.md`, line 39 **Vulnerability Type**: Shell command injection in documented integration guidance **Risk Level**: High **Vulnerable Code Snippet**: ```bash python3 skills/arya-model-router/router.py --text "<user message>" --context-chars 65000 ``` ### Technical Analysis The integration example instructs an agent or developer to place an untrusted user message directly inside a shell command. Double quotes do not neutralize all shell syntax. In common shells, command substitutions such as `$(command)` and backticks are evaluated even when they appear inside double quotes. Embedded quotation marks may also terminate the intended argument and introduce additional shell operators. The Python script itself uses `argparse` and does not invoke a shell. The vulnerability arises if an integrating agent follows the documented pattern by constructing a command string and executing it through a shell. Exploitability therefore depends on the integration using shell interpretation rather than a direct argument-vector API. ### Attack Path 1. An attacker supplies a message containing shell metacharacters or command substitution, such as `$(attacker_command)`. 2. An integrating agent replaces `<user message>` with that input in the documented command. 3. The integration submits the resulting command string to a shell. 4. The shell evaluates the injected syntax before `router.py` starts. 5. The injected command executes with the operating-system privileges of the agent or integration process. ### Impact Assessment Successful exploitation permits arbitrary command execution under the account running the integration. Depending on that account's permissions, an attacker could read or modify accessible files, obtain environment variables or credentials, destroy data, tamper with routing state or configuration, invoke network utilities, or use the compromised process as a footho ...[truncated 299 chars]
- Remediation
- ## Remediation Suggestions - Do not construct a shell command by concatenating or interpolating user-controlled text. - Invoke the script with an argument vector and disable shell interpretation: ```python subprocess.run( [ "python3", "skills/arya-model-router/router.py", "--text", user_message, "--context-chars", "65000", ], shell=False, check=True, ) ``` - Prefer a native Python function call when the router and integration run in the same application. - Alternatively, redesign the interface to accept the message through standard input while keeping fixed command-line arguments. - Update `README.md` to explicitly prohibit `shell=True`, `os.system`, and equivalent shell-string execution with untrusted input. - If a shell is unavoidable, apply platform-specific escaping through a well-tested library. Treat escaping as a secondary control rather than a substitute for argument-vector execution. - Run the integration under a least-privileged account with restricted filesystem, credential, and network access to reduce impact if another injection flaw occurs.