T09 · Insecure Skill Coding Practices
Error
- Location
- playbook.md:22
- Finding
- Shell Command Injection Through User-Controlled Industry or Law Name## Vulnerability Details **File Location**: `playbook.md`, lines 22–25 **Vulnerability Type**: Shell command injection **Risk Level**: High **Vulnerable Code**: ```markdown ### 2-1. 허가·신고 법령 → law-search 연계 ```bash bash skills/law-search/scripts/law_search.sh "[업종] 허가 신고" 5 bash skills/law-search/scripts/law_search.sh "[법령명]" 3 ``` ``` ### Technical Analysis The playbook directs the agent to interpolate an industry name or law name into a Bash command. The industry name is free-form user input required by the License Check workflow, as documented in `playbook.md:14` and `references/intent_router.md:27`. Double quotes do not make arbitrary text safe for shell evaluation. Bash still evaluates command substitutions such as `$(command)` and backtick expressions inside double-quoted strings. If the agent replaces either placeholder with untrusted input and executes the resulting command through a shell, the input can alter command evaluation. For example, an attacker-controlled industry value containing `$(attacker_command)` would cause Bash to execute `attacker_command` before invoking `law_search.sh`. The actual reachable impact depends on the privileges, environment, filesystem access, network access, and sandboxing of the agent runtime. ### Attack Path 1. An attacker submits a License Check request with a malicious industry or law-name value containing Bash command-substitution syntax. 2. The agent classifies the request as License Check and follows the data-collection procedure in `playbook.md`. 3. The agent substitutes the untrusted value into the documented shell command. 4. The command is passed to Bash for evaluation. 5. Bash evaluates the injected command substitution before running `law_search.sh`. 6. The injected command executes with the permissions of the agent process. ### Impact Assessment Successful exploitation permits arbitrary command execution within the agent runtime's security boundary. ...[truncated 732 chars]
- Remediation
- ## Remediation Suggestions 1. **Avoid shell-string construction.** Invoke `law_search.sh` using a process API that accepts an argument array and does not start a shell. For example, pass the script path, search term, and result limit as separate arguments. 2. **Validate untrusted values.** Apply an allowlist appropriate for Korean and English industry or law names. Reject shell metacharacters, control characters, newlines, command substitutions, redirection operators, and unexpected path syntax. 3. **Use positional parameters if Bash is unavoidable.** Supply validated input as a positional parameter to a fixed script rather than inserting it into command text that Bash reevaluates. 4. **Do not rely on double quotes alone.** Explicitly document that placeholders must never be replaced in an evaluated command string. 5. **Apply least privilege.** Run the workflow in a sandbox with minimal filesystem permissions, no unnecessary credentials, restricted executable access, and outbound network controls. 6. **Add adversarial tests.** Test inputs containing `$(...)`, backticks, semicolons, pipes, redirections, newlines, quotes, and long malformed values, and verify that none are interpreted by a shell. 7. **Prefer a structured integration.** Expose the law-search functionality as a typed tool or API with a string parameter and numeric result limit instead of documenting raw shell commands.