T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:20
- Finding
- Shell Command Injection Through Unsafe Dynamic sed Substitution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20–30 **Vulnerability Type**: Shell command injection caused by unsafe interpolation into generated `sed` commands **Risk Level**: High ### Vulnerable Code ```bash TEMPLATE=$(cat workspace/skills/gog-html-email/templates/basic.html) HTML=$(echo "$TEMPLATE" | sed 's/\[NAME\]/John/g' | sed 's/\[MESSAGE\]/Your message here/g' | sed 's/\[SIGNATURE\]/Your Name/g') gog gmail send --to recipient@example.com --subject "Subject" --body-html "$HTML" ``` The same dynamic `sed` construction pattern is repeated throughout `SKILL.md`, including the examples and customization instructions at lines 143–186 and 228–316. ### Technical Analysis The skill mandates constructing shell commands in which email fields are inserted directly into `sed` replacement expressions. It does not define a safe encoding procedure for shell syntax or `sed` replacement syntax. If an agent replaces the example values with attacker-controlled text while preserving this command structure, a single quote can terminate the quoted `sed` expression. The remaining input can then be interpreted as shell syntax. Even when shell injection is not achieved, replacement metacharacters such as `&`, backslashes, and the selected delimiter can modify or corrupt the generated HTML. This flaw crosses two parsing boundaries: 1. User-controlled data is embedded in a `sed` expression without `sed`-specific escaping. 2. That expression is embedded in shell source without shell-safe argument handling. Consequently, ordinary email content is treated partly as executable syntax rather than exclusively as data. ### Attack Path 1. An attacker supplies an email field such as a recipient name, message, signature, topic, or URL containing shell metacharacters and a single quote. 2. The agent follows the documented workflow and substitutes that value into a single-quoted `sed` command. 3. The malicious quote closes the intended `sed` argument. 4. T ...[truncated 1187 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not construct shell source by interpolating email fields into `sed` expressions. 2. Replace the shell-based rendering workflow with a dedicated renderer that: - Reads the template as data. - Accepts replacement values through structured arguments, standard input, or a JSON document. - Performs literal placeholder replacement. - Applies context-aware HTML escaping. - Invokes `gog` through an argument array rather than a generated command string. 3. If shell tooling must be retained: - Pass dynamic values through environment variables or files instead of embedding them in command text. - Escape all `sed` replacement metacharacters, including backslashes, ampersands, and delimiters. - Never use `eval`, `sh -c`, or equivalent secondary shell parsing. - Use `printf '%s'` rather than `echo` for arbitrary data. 4. Validate recipient addresses, subjects, URLs, and other structured fields before rendering. 5. Add tests containing single quotes, semicolons, command substitutions, backticks, ampersands, backslashes, and delimiter characters. 6. Run the email-sending process with minimum filesystem, credential, and network privileges. ]]>