T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:23- Finding
Shell Command Injection Through Interpolated LLM Output and Stock Codes
- Content
View full analysis
' | python3 {baseDir}/scripts/validate_step.py --step <步骤名> --stock-code <股票代码> --attempt <次数> ``` The logging setup also places a stock code in a shell command: ```bash export TRADINGAGENTS_LOG_FILE="{baseDir}/scripts/logs/{股票代码}_{YYYYMMDD}_{HHMMSS}.log" mkdir -p {baseDir}/scripts/logs ``` Equivalent raw-output interpolation is specified repeatedly, including: ```bash echo '' | python3 {baseDir}/scripts/validate_step.py --step bull_analyst --stock-code {股票代码} --attempt 1 ``` ### Technical Analysis The workflow instructs the Agent to insert raw LLM output directly into a single-quoted shell argument. Single quotes appearing in model output terminate the intended argument. The remaining text is then interpreted as shell syntax. LLM output is not a trusted boundary. It can be influenced by: - Direct user-supplied text. - OCR content from attacker-controlled images. - Search-result titles and snippets. - Prompt injection contained in external content. - Previous analysis-stage output. The stock code is also inserted into shell commands. In the double-quoted `export` command, shell substitutions such as `$(command)` remain active. Therefore, treating the stock code as a benign identifier is insufficient. The Python validator itself safely reads standard input, so no shell interpolation is necessary. The vulnerability is introduced by the Skill's prescribed invocation method. ### Attack Path 1. An attacker supplies a stock description, stock code, OCR image, or external text that influences an LLM response. 2. The generated response includes a single quote followed by shell syntax, for example a sequence concep ...[truncated 1408 chars]- Remediation
View remediation