T09 · Insecure Skill Coding Practices
Error
- Location
playbook.md:22- Finding
Shell Command Injection Through User-Controlled Industry or Law Name
- Content
View full analysis
Vulnerability Details
File Location:
playbook.md, lines 22–25
Vulnerability Type: Shell command injection
Risk Level: HighVulnerable Code:
markdown ### 2-1. 허가·신고 법령 → law-search 연계 ```bash bash skills/law-search/scripts/law_search.sh "[업종] 허가 신고" 5 bash skills/law-search/scripts/law_search.sh "[법령명]" 3text ### Technical Analysis The playbook directs the agent to interpolate an industry name or law name into a Bash command. The industry name is free-form user input required by the License Check workflow, as documented in `playbook.md:14` and `references/intent_router.md:27`. Double quotes do not make arbitrary text safe for shell evaluation. Bash still evaluates command substitutions such as `$(command)` and backtick expressions inside double-quoted strings. If the agent replaces either placeholder with untrusted input and executes the resulting command through a shell, the input can alter command evaluation. For example, an attacker-controlled industry value containing `$(attacker_command)` would cause Bash to execute `attacker_command` before invoking `law_search.sh`. The actual reachable impact depends on the privileges, environment, filesystem access, network access, and sandboxing of the agent runtime. ### Attack Path 1. An attacker submits a License Check request with a malicious industry or law-name value containing Bash command-substitution syntax. 2. The agent classifies the request as License Check and follows the data-collection procedure in `playbook.md`. 3. The agent substitutes the untrusted value into the documented shell command. 4. The command is passed to Bash for evaluation. 5. Bash evaluates the injected command substitution before running `law_search.sh`. 6. The injected command executes with the permissions of the agent process. ### Impact Assessment Successful exploitation permits arbitrary command execution within the agent runtime's security boundary. ...[truncated 732 chars]- Remediation
View remediation
Remediation Suggestions
- Avoid shell-string construction. Invoke
law_search.shusing a process API that accepts an argument array and does not start a shell. For example, pass the script path, search term, and result limit as separate arguments. - Validate untrusted values. Apply an allowlist appropriate for Korean and English industry or law names. Reject shell metacharacters, control characters, newlines, command substitutions, redirection operators, and unexpected path syntax.
- Use positional parameters if Bash is unavoidable. Supply validated input as a positional parameter to a fixed script rather than inserting it into command text that Bash reevaluates.
- Do not rely on double quotes alone. Explicitly document that placeholders must never be replaced in an evaluated command string.
- Apply least privilege. Run the workflow in a sandbox with minimal filesystem permissions, no unnecessary credentials, restricted executable access, and outbound network controls.
- Add adversarial tests. Test inputs containing
$(...), backticks, semicolons, pipes, redirections, newlines, quotes, and long malformed values, and verify that none are interpreted by a shell. - Prefer a structured integration. Expose the law-search functionality as a typed tool or API with a string parameter and numeric result limit instead of documenting raw shell commands.
- Avoid shell-string construction. Invoke