T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/send_voice_feishu.sh:6
- Finding
- Python Code Injection Through the Recipient Identifier<![CDATA[ ## Vulnerability Details **File Location**: `scripts/send_voice_feishu.sh`, lines 6 and 52 **Vulnerability Type**: Command injection caused by embedding untrusted input in dynamically generated Python source **Risk Level**: High ### Vulnerable Code ```bash RECEIVER_ID="${3:-ou_94f3936f1896b5378404f377da3fae6f}" ``` ```bash local json_payload=$(python3 -c "import json; print(json.dumps({\"receive_id\": \"$RECEIVER_ID\", \"msg_type\": \"audio\", \"content\": json.dumps({\"file_key\": \"$file_key\"})}))") ``` ### Technical Analysis The script accepts the recipient identifier from its third positional argument and interpolates it directly into a string passed to `python3 -c`. The recipient is therefore treated as part of executable Python source rather than strictly as data. An attacker who can control the third argument can supply characters that terminate the intended Python string or expression and introduce additional Python statements or expressions. Those statements execute with the same operating-system privileges and environment access as the Skill process. Shell quoting does not adequately protect this operation because the injection occurs when Python parses the generated source. The same construction also risks malformed JSON or failed delivery when the identifier contains unexpected characters. ### Attack Path 1. The attacker obtains the ability to invoke the script or influence the recipient argument passed by an Agent or wrapper. 2. The attacker supplies a crafted third argument containing Python syntax that escapes the intended string context. 3. Bash interpolates that value into the source provided to `python3 -c`. 4. Python parses and executes the injected code while constructing the JSON payload. 5. The injected code can invoke local commands, read accessible files, or transmit data using the privileges of the Skill process. ### Impact Assessment Successful exploitation provides arbitrary code execution under the account runnin ...[truncated 470 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Never interpolate recipient identifiers or other data into executable Python source. Pass the values as positional arguments and read them through `sys.argv`, for example: ```bash json_payload="$( python3 - "$RECEIVER_ID" "$file_key" <<'PY' import json import sys receiver_id = sys.argv[1] file_key = sys.argv[2] print(json.dumps({ "receive_id": receiver_id, "msg_type": "audio", "content": json.dumps({"file_key": file_key}), })) PY )" ``` Additionally: 1. Validate the recipient against the expected Feishu open-ID syntax before use. 2. Reject control characters, newlines, and empty identifiers. 3. Prefer a dedicated JSON builder such as `jq --arg` where available. 4. Add tests with quotes, backslashes, newlines, and code-like input. 5. Ensure all variables are consistently quoted and use `set -euo pipefail` to stop on unexpected failures. ]]>