T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:82- Finding
Arbitrary Shell Command Execution Through Unescaped Configuration Output
- Content
View full analysis
/dev/null 2>&1; then return 1; fi if [[ ! -f "$file" ]]; then return 1; fi scheme=$(jq -r '.expo.scheme // empty' "$file" 2>/dev/null || true) # `scheme` may be an array; pick the first if so if [[ -z "$scheme" ]]; then scheme=$(jq -r '.expo.scheme[0] // empty' "$file" 2>/dev/null || true) fi ios_bundle=$(jq -r '.expo.ios.bundleIdentifier // empty' "$file" 2>/dev/null || true) android_pkg=$(jq -r '.expo.android.package // empty' "$file" 2>/dev/null || true) [[ -n "$scheme" || -n "$ios_bundle" || -n "$android_pkg" ]] } ``` `assets/detect-app-config.sh:41-52`: ```bash read_from_expo_cli() { if ! command -v npx >/dev/null 2>&1; then return 1; fi local json json=$(npx --no-install expo config --type public --json 2>/dev/null) || return 1 if ! command -v jq >/dev/null 2>&1; then return 1; fi scheme=$(printf '%s' "$json" | jq -r '.scheme // empty' 2>/dev/null || true) if [[ -z "$scheme" ]]; then scheme=$(printf '%s' "$json" | jq -r '.scheme[0] // empty' 2>/dev/null || true) fi ios_bundle=$(printf '%s' "$json" | jq -r '.ios.bundleIdentifier // empty' 2>/dev/null || true) android_pkg=$(printf '%s' "$json" | jq -r '.android.package // empty' 2>/dev/null || true) [[ -n "$scheme" || -n "$ios_bundle" || -n "$android_pkg" ]] } ``` `assets/detect-app-config.sh:62-64`: ```bash printf 'APP_SCHEME=%s\n' "$scheme" printf 'IOS_BUNDLE_ID=%s\n' "$ios_bundle" printf 'ANDROID_PACKAGE=%s\n' "$android_pkg" ``` ### Technical Analysis The dete ...[truncated 2334 chars]- Remediation
View remediation