T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:36
- Finding
- Command and Argument Injection Through Unsanitized GitHub CLI Parameters<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 36–48 **Vulnerability Type**: User-controlled shell command construction **Risk Level**: High ### Vulnerable Code ```markdown 5. **After approval, ask for target repo:** - Run: `gh repo list <org> --limit 50 --json name,description` - Show list, user picks 6. **Ask for project board:** - First check auth scope: `gh auth status` — if `project` scope is missing, tell user to run `gh auth refresh -s project` - Run: `gh project list --owner <org> --format json` - Show list, user picks 7. **Create and link:** - `gh issue create --repo <org>/<repo> --title "<title>" --body "<body>"` - `gh project item-add <project-number> --owner <org> --url <issue-url>` - Show the issue URL ``` ### Technical Analysis The Skill directs the Agent to interpolate organization names, repository names, project numbers, issue URLs, titles, and issue bodies into command strings. These values can originate from user input, supplied API documentation, or previous command output. The instructions do not require validation, escaping, argument-array execution, or avoidance of a command shell. Double quotes around `<title>` and `<body>` are not sufficient shell protections. Shell constructs such as command substitution using `$(...)` or backticks remain active inside double-quoted strings. Embedded quotation marks can also terminate the intended argument, while values beginning with hyphens can potentially be interpreted as unintended options. Multiline issue bodies further increase the likelihood of unsafe command construction. If the Agent executes the resulting string through a shell, attacker-controlled text can therefore alter the command or trigger local command execution. ### Attack Path 1. An attacker supplies endpoint details containing a malicious issue title or body, such as text with shell command substitution. 2. The Skill incorporates that content into the generated issue card. ...[truncated 1259 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Execute `gh` directly with a structured argument array rather than assembling a shell command string. Do not use `sh -c`, `bash -c`, `eval`, or equivalent shell evaluation. 2. Pass issue content through a securely created temporary file and use `gh issue create --body-file <file>`. Create the file with restrictive permissions, avoid predictable names, and delete it after use. 3. Validate organization and repository identifiers against GitHub's permitted naming syntax. Reject whitespace, control characters, shell metacharacters, and values beginning with an option prefix. 4. Require project numbers to contain digits only. 5. Accept issue URLs only after parsing them as URLs and verifying the expected HTTPS scheme, GitHub host, organization, and repository. 6. Preserve titles as a single API argument and reject embedded NUL bytes and control characters. 7. Prefer the GitHub API or an SDK with structured parameters when available, avoiding shell interpretation entirely. 8. Before execution, display and require confirmation of the normalized repository, project, issue title, and destination URL without exposing a shell command for manual execution. 9. Add an explicit security rule to the Skill stating that all values originating from users, specifications, issue content, and CLI output are untrusted and must never be interpolated into shell commands. ]]>