T09 · Insecure Skill Coding Practices
- Location
scripts/transcribe.sh:71- Finding
Curl Option Injection Through Unquoted Optional Argument Expansion
- Content
View full analysis
Vulnerability Details
File Location:
scripts/transcribe.sh, lines 71–79
Vulnerability Type: Argument injection caused by unquoted shell expansion
Risk Level: MediumVulnerable Code:
bash curl -sS https://api.openai.com/v1/audio/transcriptions \ -H "Authorization: Bearer $OPENAI_API_KEY" \ -H "Accept: application/json" \ -F "file=@${in}" \ -F "model=${model}" \ -F "response_format=${response_format}" \ ${language:+-F "language=${language}"} \ ${prompt:+-F "prompt=${prompt}"} \ >"$out"Technical Analysis
The optional
languageandpromptarguments are incorporated into thecurlcommand through unquoted parameter expansions:bash ${language:+-F "language=${language}"} ${prompt:+-F "prompt=${prompt}"}Shell quotation marks generated inside a parameter expansion do not become shell syntax. They remain literal characters. Because the outer expansions are unquoted, their results are subject to word splitting and pathname expansion.
Consequently, whitespace in an attacker-controlled
--languageor--promptvalue can divide the expansion into multiple command-line arguments. Tokens beginning with a hyphen can then be interpreted bycurlas additional options rather than as part of a multipart form value. Glob characters may also expand to local filesystem paths.This is an argument-injection vulnerability rather than direct shell-command injection: shell metacharacters embedded in the variable are not reparsed as shell syntax. Nevertheless, injected
curloptions can materially alter network and file behavior.Attack Path
- An attacker influences a prompt or language value passed to the skill, such as through untrusted content that an agent uses when constructing the transcription request.
- The caller preserves that content as one argument to
--promptor--language. - The script stores the content in
promptorlanguage. - T ...[truncated 1702 chars]
- Remediation
View remediation
Remediation Suggestions
Construct the complete
curlargument list using a Bash array. Append each optional form field as a distinct array element so that attacker-controlled whitespace and wildcard characters cannot create additional arguments:bash curl_args=( -sS "https://api.openai.com/v1/audio/transcriptions" -H "Authorization: Bearer $OPENAI_API_KEY" -H "Accept: application/json" -F "file=@${in}" -F "model=${model}" -F "response_format=${response_format}" ) if [[ -n "$language" ]]; then curl_args+=(-F "language=${language}") fi if [[ -n "$prompt" ]]; then curl_args+=(-F "prompt=${prompt}") fi curl "${curl_args[@]}" >"$out"Additionally:
- Validate
languageagainst the expected language-code syntax or an explicit allowlist. - Validate
modelagainst supported model identifiers. - Consider constraining the output path if arguments may originate from untrusted users.
- Use
curl --fail-with-bodyand write to a temporary file followed by an atomic rename, preventing API error responses or interrupted transfers from replacing a valid output file. - Add regression tests containing spaces, leading hyphens, wildcard characters, and option-like prompt values to verify that every form value remains exactly one
curlargument.
- Validate