T09 · Insecure Skill Coding Practices
Error
- Location
src/patch-executor.js:166- Finding
Shell Command Injection Through Command-History-Derived Alias Data
- Content
View full analysis
cmd.trim()); const commandCounts = {}; commands.forEach(cmd => { const baseCmd = cmd.split(' ')[0]; if (baseCmd && baseCmd.length > 2) { commandCounts[baseCmd] = (commandCounts[baseCmd] || 0) + 1; } }); Object.entries(commandCounts).forEach(([cmd, count]) => { if (count >= (config.min_usage_count || 3)) { const suggestedAlias = cmd.length > 4 ? cmd.substring(0, 2) : cmd; opportunities.push({ type: 'shell_alias', original_command: cmd, suggested_alias: suggestedAlias, rollback_command: `unalias ${suggestedAlias}` }); } }); } ``` ```js // src/patch-executor.js const checkAlias = execSync( `alias ${suggested_alias} 2>/dev/null || true`, { encoding: 'utf8', shell: '/bin/bash' } ); execSync( `which ${original_command.split(' ')[0]} >/dev/null 2>&1 || true`, { shell: '/bin/bash' } ); const aliasCommand = `alias ${suggested_alias}='${original_command}'`; execSync(aliasCommand, { stdio: 'pipe', shell: '/bin/bash' }); ``` ### Technical Analysis The detector reads command names from a user-writable shell history file and propagates them into an execution opportunity without validating the resulting alias or command. The executor then interpolates these values directly into shell command strings evaluated by `/bin/bash`. Quoting `original_command` with single quotes is insufficient because an attacker-controlled co ...[truncated 1974 chars]- Remediation
View remediation