T09 · Insecure Skill Coding Practices
Error
- Location
scripts/engage.mjs:131- Finding
PowerShell Command Injection and Wallet Secret Exposure in Farcaster Posting
- Content
View full analysis
`$env:${k}="${v}"`).join('; '); const cmd = `${envStr}; node skills/farcaster-agent/src/post-cast.js "${replyText.replace(/"/g, '\\"')}"`; try { const output = execSync(cmd, { encoding: 'utf8', shell: 'powershell.exe' }); ``` ### Technical Analysis The function constructs executable PowerShell source by directly interpolating configuration values, Farcaster metadata, and generated reply text. Replacing double quotes with `\"` does not safely escape a value for PowerShell. PowerShell recognizes additional control and interpolation syntax, including semicolons, backticks, newlines, variable references, and `$()` subexpressions. The reply may contain a phrase selected from the configurable `persona.phrases` array. Consequently, a crafted configuration can introduce PowerShell syntax into `replyText`. The values used for `FID`, `PARENT_FID`, and `PARENT_HASH` are also interpolated without strict validation. In addition, `PRIVATE_KEY` and `SIGNER_PRIVATE_KEY` are embedded directly in the command string. This unnecessarily exposes high-value wallet credentials to the shell command channel and may reveal them through process inspection, command logging, debugging output, monitoring systems, or exceptions containing command details. Executing through `powershell.exe` is unnecessary for the declared task. The child process can be launched directly with a ...[truncated 1749 chars]- Remediation
View remediation