T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:82
- Finding
- Arbitrary Shell Command Execution Through Unescaped Configuration Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:82`; supporting implementation in `assets/detect-app-config.sh:27-38`, `assets/detect-app-config.sh:41-52`, and `assets/detect-app-config.sh:62-64` **Vulnerability Type**: Command injection through unsafe `eval` **Risk Level**: High ### Vulnerable Code `SKILL.md:82`: ```bash eval "$(bash assets/detect-app-config.sh path/to/app)" ``` `assets/detect-app-config.sh:27-38`: ```bash read_from_jq() { local file="$1" if ! command -v jq >/dev/null 2>&1; then return 1; fi if [[ ! -f "$file" ]]; then return 1; fi scheme=$(jq -r '.expo.scheme // empty' "$file" 2>/dev/null || true) # `scheme` may be an array; pick the first if so if [[ -z "$scheme" ]]; then scheme=$(jq -r '.expo.scheme[0] // empty' "$file" 2>/dev/null || true) fi ios_bundle=$(jq -r '.expo.ios.bundleIdentifier // empty' "$file" 2>/dev/null || true) android_pkg=$(jq -r '.expo.android.package // empty' "$file" 2>/dev/null || true) [[ -n "$scheme" || -n "$ios_bundle" || -n "$android_pkg" ]] } ``` `assets/detect-app-config.sh:41-52`: ```bash read_from_expo_cli() { if ! command -v npx >/dev/null 2>&1; then return 1; fi local json json=$(npx --no-install expo config --type public --json 2>/dev/null) || return 1 if ! command -v jq >/dev/null 2>&1; then return 1; fi scheme=$(printf '%s' "$json" | jq -r '.scheme // empty' 2>/dev/null || true) if [[ -z "$scheme" ]]; then scheme=$(printf '%s' "$json" | jq -r '.scheme[0] // empty' 2>/dev/null || true) fi ios_bundle=$(printf '%s' "$json" | jq -r '.ios.bundleIdentifier // empty' 2>/dev/null || true) android_pkg=$(printf '%s' "$json" | jq -r '.android.package // empty' 2>/dev/null || true) [[ -n "$scheme" || -n "$ios_bundle" || -n "$android_pkg" ]] } ``` `assets/detect-app-config.sh:62-64`: ```bash printf 'APP_SCHEME=%s\n' "$scheme" printf 'IOS_BUNDLE_ID=%s\n' "$ios_bundle" printf 'ANDROID_PACKAGE=%s\n' "$android_pkg" ``` ### Technical Analysis The dete ...[truncated 2334 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the documented use of `eval`. 2. Have the detection script return a structured format such as JSON: ```bash jq -n \ --arg scheme "$scheme" \ --arg ios "$ios_bundle" \ --arg android "$android_pkg" \ '{APP_SCHEME: $scheme, IOS_BUNDLE_ID: $ios, ANDROID_PACKAGE: $android}' ``` 3. Parse each value as data rather than executable shell text: ```bash config_json="$(bash assets/detect-app-config.sh path/to/app)" APP_SCHEME="$(jq -r '.APP_SCHEME' <<<"$config_json")" IOS_BUNDLE_ID="$(jq -r '.IOS_BUNDLE_ID' <<<"$config_json")" ANDROID_PACKAGE="$(jq -r '.ANDROID_PACKAGE' <<<"$config_json")" ``` 4. Validate values using conservative allowlists before using them. Reject control characters, whitespace, shell metacharacters, and values outside the expected scheme or identifier syntax. 5. If shell assignments must be retained for compatibility, serialize every value with `printf '%q'`; however, direct structured parsing without `eval` is preferred. 6. Add regression tests using values containing spaces, quotes, semicolons, backticks, and command substitutions, verifying that no command is executed. ]]>