T09 · Insecure Skill Coding Practices
- Location
SKILL.md:53- Finding
Execution of Untrusted Commands from Repository Instructions and Agent Reports
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:53-55,SKILL.md:132, andSKILL.md:232-234
Vulnerability Type: Untrusted command execution
Risk Level: HighVulnerable Code Snippets
SKILL.md:53-55:text Run the project's lint + type-check command. Check CLAUDE.md (or the equivalent project instructions) for the correct validation command - commonly `pnpm check`, `just check`, `cargo clippy`, `uv run ruff check`. If none is documented, ask.SKILL.md:132:text - Every finding carries reproducible evidence: the code site as `file:line`, the check performed as an exact command with its observed output (for a purely code-local finding, the quoted code itself is the check), and the source of any external fact as a path or URL. A finding whose evidence cannot be reproduced from its citations is a claim, and claims do not survive validationSKILL.md:232-234:text **Reproduce, do not re-derive.** For each finding, run the command it cites and compare the output; open the exact file and lines and confirm the code matches; follow the path or URL behind any external fact.Technical Analysis
The Skill directs the Agent to obtain validation commands from repository-controlled instruction files such as
CLAUDE.md. It also requires the Agent to execute exact commands supplied in spawned-agent reports. Neither source is necessarily trusted: a repository under audit may be malicious, and agent findings can reproduce attacker-controlled instructions originating from that repository.No command allowlist, shell-metacharacter validation, sandbox requirement, permission restriction, or explicit user confirmation is required before these commands are executed. The instruction to follow externally cited URLs also expands the trust boundary beyond the local repository.
This creates an indirect command-injection channel. Content presented as a lint command or evidence-reproduct ...[truncated 1497 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat repository instructions, source files, diffs, issue text, and spawned-agent reports as untrusted data.
- Resolve validation commands from recognized manifests and fixed project configuration rather than arbitrary prose files.
- Maintain an allowlist of permitted executables and argument forms. Reject shell operators, substitutions, redirections, pipelines, and dynamically constructed commands unless explicitly approved.
- Display any non-allowlisted command to the user and require explicit confirmation before execution.
- Run validation and reproduction commands in an isolated sandbox with:
- Access limited to the reviewed repository.
- No inherited secrets unless strictly required.
- Network access disabled by default.
- Resource and execution-time limits.
- A non-privileged operating-system identity.
- Do not automatically follow arbitrary URLs. Validate the scheme and destination, block local and private-network targets where appropriate, and request approval before external access.
- Require reviewer reports to provide evidence as inert text. The parent Agent should independently reconstruct safe checks instead of executing report-supplied command strings verbatim.