T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/gog-stale-scan.sh:25
- Finding
- Shell Command Execution Through Unvalidated STALE_DAYS Arithmetic Expression<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gog-stale-scan.sh`, lines 6 and 25 **Vulnerability Type**: Shell arithmetic injection **Risk Level**: High ### Vulnerable Code ```bash STALE_DAYS="${STALE_DAYS:-30}" ``` ```bash CUTOFF_EPOCH=$(( $(date +%s) - STALE_DAYS * 86400 )) ``` ### Technical Analysis The script accepts `STALE_DAYS` from the process environment without verifying that it contains only a valid decimal integer. It subsequently references that variable inside a Bash arithmetic expansion. Bash arithmetic expressions recursively evaluate variable values as arithmetic syntax. Crafted expressions can abuse arithmetic constructs, including evaluated array subscripts and nested shell expansions, to trigger command execution. Quoting the original environment-variable assignment does not prevent this because the dangerous interpretation occurs later inside `$((...))`. An attacker capable of controlling the environment used to invoke the Skill could therefore provide a malicious arithmetic expression instead of a numeric day count. The payload would be evaluated when the script calculates `CUTOFF_EPOCH`, before the GOG library is processed. ### Attack Path 1. An attacker gains the ability to influence the `STALE_DAYS` environment variable, such as through an Agent-controlled invocation, wrapper script, automation configuration, or inherited process environment. 2. The attacker supplies a Bash arithmetic expression containing a command-executing expansion rather than a decimal integer. 3. Line 6 accepts the malicious value without validation. 4. Line 25 evaluates the value as part of the arithmetic expression used to calculate the cutoff timestamp. 5. The embedded command executes with the operating-system privileges and environment of the Skill process. ### Impact Assessment Successful exploitation provides arbitrary local command execution under the account running the Skill. The attacker could read or modify files accessible t ...[truncated 462 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Validate `STALE_DAYS` before using it in any arithmetic context. Require an ASCII decimal integer and enforce a reasonable operational range: ```bash if [[ ! "$STALE_DAYS" =~ ^[0-9]+$ ]]; then echo "Invalid STALE_DAYS: expected a positive integer" >&2 exit 1 fi if (( 10#$STALE_DAYS < 1 || 10#$STALE_DAYS > 36500 )); then echo "Invalid STALE_DAYS: value is outside the allowed range" >&2 exit 1 fi CUTOFF_EPOCH=$(( $(date +%s) - 10#$STALE_DAYS * 86400 )) ``` The `10#` prefix forces decimal interpretation and avoids unexpected octal handling for values with leading zeroes. Validation must occur before the variable is referenced inside any arithmetic expansion. Apply the same allow-list approach to every environment-controlled value that may enter shell arithmetic or command syntax. ]]>