T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:51- Finding
Shell Command Injection Through an Unvalidated Scenario Name
- Content
View full analysis
.yaml` — the scenario config - `weights-.yaml` — family weights for Judgment (optional) Use templates/scenario.yaml.tmpl and templates/weights.yaml.tmpl as starting points. Substitute the values from Stage 1. Show the user the generated scenario.yaml and ask: *"Look right, or tweak anything before we run?"* Keep this confirmation to one round — don't re-litigate Stage 1. ## Stage 3 — Rollout Invoke the runner via Bash: \``` memory-bench run --scenario scenario-.yaml --out results// --embedding --composite \``` ``` ### Technical Analysis The Skill directs the agent to use a scenario name in filenames and then interpolate that value directly into a command executed through Bash. It does not require validation, normalization, shell escaping, or an argument-array process API. If the generated name contains shell metacharacters such as semicolons, command substitutions, redirection operators, or whitespace, Bash can interpret part of the value as command syntax rather than as a filename. The value may be influenced by the user's requested use-case or scenario name. For example, if a scenario name equivalent to the following were used verbatim: ```text demo; attacker-command ``` the resulting Bash command could be interpreted as multiple commands. The project does not contain such a malicious value; the vulnerability is the documented unsafe command-construction pattern. ### Attack Path 1. An attacker requests a benchmark and supplies or induces a scenario name containing shell metacharacters. 2. The agent uses that name when creating `scenario-.yaml` and the output directory. 3. Following the Skill instructions, the agent substitute ...[truncated 1040 chars]- Remediation
View remediation