T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/release-digest.sh:28
- Finding
- Unsanitized Repository Metadata Can Manipulate Agent-Generated Release Digests## Vulnerability Details **File Location**: `scripts/release-digest.sh`, lines 28-31 **Vulnerability Type**: Improper neutralization of untrusted repository content **Risk Level**: Medium ### Vulnerable Code ```bash printf '### Commits\n\n' git log --no-merges --reverse --format='- %s (%an) `%h`' "$range" 2>/dev/null || true printf '\n### Files changed\n\n' git diff --stat "$range" 2>/dev/null || true ``` The output-handling instruction in `SKILL.md`, lines 39-41, further directs the agent to return this generated content: ```markdown 3. Hand the printed Markdown back to the caller. Never paste secrets, tokens, or private filenames that the commit log may surface — redact before replying. ``` ### Technical Analysis The script inserts Git commit subjects (`%s`), author names (`%an`), and changed file paths directly into Markdown without escaping Markdown syntax or removing terminal control characters. These values can be controlled by anyone capable of introducing commits or filenames into the audited repository. Although command arguments are quoted and no shell command injection is present, the generated document crosses a trust boundary: repository-controlled text is returned to an AI agent and subsequently presented to a user. A malicious value may contain instruction-like text, deceptive links, Markdown formatting, backticks, bidirectional text characters, or ANSI terminal escape sequences. The instruction in `SKILL.md` requires secret and private-filename redaction but does not require the agent to treat repository-derived content strictly as untrusted data. Consequently, crafted repository metadata could be interpreted as instructions by an agent or could manipulate the appearance of the rendered response. ### Attack Path 1. An attacker obtains permission to contribute a commit or create a tracked filename in the target repository. 2. The attacker creates a commit subject, author name, or filename containing malicious Markdown, terminal contro ...[truncated 1187 chars]
- Remediation
- ## Remediation Suggestions 1. Treat every commit subject, author name, and filename as untrusted data. 2. Strip C0/C1 control characters, ANSI escape sequences, and unsafe bidirectional formatting characters before producing output. 3. Escape Markdown metacharacters in repository-derived values, including backticks, brackets, parentheses, angle brackets, and backslashes. 4. Use NUL-delimited Git output where possible so unusual filenames and record boundaries can be processed safely. 5. Avoid passing raw `git diff --stat` output directly to the response. Parse structured Git output and render each field through a dedicated sanitizer. 6. Update `SKILL.md` to state explicitly that repository content is data only and must never be followed as instructions. 7. Consider wrapping untrusted values in a clearly labeled, inert representation rather than interpolating them directly into normal prose. 8. Add regression tests covering ANSI escapes, multiline metadata, Markdown links, backticks, bidirectional characters, and unusual filenames.