T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:44- Finding
Command Injection Through Unquoted User-Controlled Hostname Prefix
- Content
View full analysis
- ``` ``` `SKILL.md:112-118`: ```bash # collector <-> categorizer: pilotctl --json handshake -categorizer "setup: expense-tracker" pilotctl --json handshake -collector "setup: expense-tracker" # categorizer <-> reporter: pilotctl --json handshake -reporter "setup: expense-tracker" pilotctl --json handshake -categorizer "setup: expense-tracker" ``` `SKILL.md:124-127`: ```bash # On categorizer -- subscribe to raw expenses: pilotctl --json subscribe -collector raw-expense # On reporter -- subscribe to categorized expenses: pilotctl --json subscribe -categorizer categorized-expense ``` The same unsafe pattern appears in the README, including: ```bash pilotctl set-hostname -collector pilotctl handshake -categorizer "setup: expense-tracker" pilotctl subscribe -collector raw-expense ``` ### Technical Analysis The setup procedure explicitly asks the user to provide a deployment prefix and subsequently interpolates that value into shell commands without quoting or validation. If an agent implements these examples through a shell after direct textual substitution, shell metacharacters ...[truncated 2173 chars]- Remediation
View remediation
&2 exit 1 fi ``` 2. Reject whitespace, shell metacharacters, control characters, path separators, substitutions, and values beginning with `-`. 3. Pass the prefix as a separately quoted argument rather than building a command string: ```bash pilotctl --json set-hostname -- "${prefix}-collector" ``` Use `--` only if `pilotctl` supports an end-of-options marker. 4. Do not execute commands using `eval`, `bash -c`, or string concatenation. 5. Apply the same validation to the selected role, or map the user's choice to a fixed allowlist containing only `collector`, `categorizer`, and `reporter`. 6. Update every setup, handshake, subscribe, and publish example in both `SKILL.md` and `README.md`. 7. Display the normalized hostname and request confirmation before making configuration or trust changes. ]]>