T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/transcribe.sh:71
- Finding
- Curl Option Injection Through Unquoted Optional Argument Expansion## Vulnerability Details **File Location**: `scripts/transcribe.sh`, lines 71–79 **Vulnerability Type**: Argument injection caused by unquoted shell expansion **Risk Level**: Medium **Vulnerable Code**: ```bash curl -sS https://api.openai.com/v1/audio/transcriptions \ -H "Authorization: Bearer $OPENAI_API_KEY" \ -H "Accept: application/json" \ -F "file=@${in}" \ -F "model=${model}" \ -F "response_format=${response_format}" \ ${language:+-F "language=${language}"} \ ${prompt:+-F "prompt=${prompt}"} \ >"$out" ``` ### Technical Analysis The optional `language` and `prompt` arguments are incorporated into the `curl` command through unquoted parameter expansions: ```bash ${language:+-F "language=${language}"} ${prompt:+-F "prompt=${prompt}"} ``` Shell quotation marks generated inside a parameter expansion do not become shell syntax. They remain literal characters. Because the outer expansions are unquoted, their results are subject to word splitting and pathname expansion. Consequently, whitespace in an attacker-controlled `--language` or `--prompt` value can divide the expansion into multiple command-line arguments. Tokens beginning with a hyphen can then be interpreted by `curl` as additional options rather than as part of a multipart form value. Glob characters may also expand to local filesystem paths. This is an argument-injection vulnerability rather than direct shell-command injection: shell metacharacters embedded in the variable are not reparsed as shell syntax. Nevertheless, injected `curl` options can materially alter network and file behavior. ### Attack Path 1. An attacker influences a prompt or language value passed to the skill, such as through untrusted content that an agent uses when constructing the transcription request. 2. The caller preserves that content as one argument to `--prompt` or `--language`. 3. The script stores the content in `prompt` or `language`. 4. T ...[truncated 1702 chars]
- Remediation
- ## Remediation Suggestions Construct the complete `curl` argument list using a Bash array. Append each optional form field as a distinct array element so that attacker-controlled whitespace and wildcard characters cannot create additional arguments: ```bash curl_args=( -sS "https://api.openai.com/v1/audio/transcriptions" -H "Authorization: Bearer $OPENAI_API_KEY" -H "Accept: application/json" -F "file=@${in}" -F "model=${model}" -F "response_format=${response_format}" ) if [[ -n "$language" ]]; then curl_args+=(-F "language=${language}") fi if [[ -n "$prompt" ]]; then curl_args+=(-F "prompt=${prompt}") fi curl "${curl_args[@]}" >"$out" ``` Additionally: - Validate `language` against the expected language-code syntax or an explicit allowlist. - Validate `model` against supported model identifiers. - Consider constraining the output path if arguments may originate from untrusted users. - Use `curl --fail-with-body` and write to a temporary file followed by an atomic rename, preventing API error responses or interrupted transfers from replacing a valid output file. - Add regression tests containing spaces, leading hyphens, wildcard characters, and option-like prompt values to verify that every form value remains exactly one `curl` argument.