T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:20
- Finding
- Shell Command Injection Through Untrusted Template Parameters<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20-21 **Vulnerability Type**: Shell command injection **Risk Level**: Critical ### Vulnerable Code ```bash TARGETS="{{targetAgents}}" MESSAGE="{{message}}" ``` ### Technical Analysis The `targetAgents` and `message` parameters are interpolated directly into executable shell source. Enclosing the resulting values in double quotes does not make this safe because shell command substitutions such as `$(command)` and backticks are still evaluated inside double-quoted assignments. An attacker can supply a notification message or target value containing shell syntax. After template expansion, the `exec` tool parses that content as part of the script and executes any embedded command substitution with the permissions of the Skill runner. Crafted quotation marks may provide additional injection possibilities depending on the template engine's handling of input. ### Attack Path 1. An attacker invokes a supported notification trigger and controls either `targetAgents` or `message`. 2. The attacker includes shell syntax, such as `$(malicious_command)`, in that value. 3. The template engine inserts the value directly into the shell script. 4. The `exec` tool passes the expanded script to Bash. 5. Bash evaluates the injected command substitution while processing the variable assignment. 6. The injected command executes with the privileges and filesystem access of the agent process. ### Impact Assessment Successful exploitation provides arbitrary local command execution under the account running the Skill. The attacker could read accessible secrets, alter files, poison agent state, invoke installed tools, or establish additional persistence. The effective scope is all resources available to the Skill runner's operating-system identity. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not interpolate untrusted values into shell source. - Replace the shell action with an implementation that uses safe filesystem APIs and passes notification values as data rather than executable text. - If a shell must be used, pass parameters as separately bound positional arguments or environment variables through an execution API that does not construct a command string. - Apply strict length and character validation to both parameters. - Run the action under a dedicated, least-privileged account with access limited to the notification directory. - Add tests covering command substitutions, backticks, quotation marks, newlines, semicolons, and other shell metacharacters. ]]>