T09 · Insecure Skill Coding Practices
Error
- Location
scripts/stock_alert.sh:119- Finding
Arbitrary Command Execution Through AWK Expression Injection
- Content
View full analysis
= $alert_pct)}"; then local sign="" awk "BEGIN{if($change_pct>=0) exit 0; exit 1}" && sign="+" || sign="" alerts+=("涨幅${sign}${change_pct}%超阈值(${alert_pct}%)") fi fi # Price above if [[ "$price_above" != "null" && -n "$price_above" ]]; then if awk "BEGIN{exit !($price > $price_above)}"; then alerts+=("价格${price}上穿${price_above}") fi fi # Price below if [[ "$price_below" != "null" && -n "$price_below" ]]; then if awk "BEGIN{exit !($price < $price_below)}"; then alerts+=("价格${price}下穿${price_below}") fi fi if [[ ${#alerts[@]} -gt 0 ]]; then local alert_msg=$(IFS='，'; echo "${alerts[*]}") local sign="" awk "BEGIN{if($change_pct>=0) exit 0; exit 1}" && sign="+" || sign="" echo "[$ts] $symbol \$$price ${sign}${change_pct}% ⚠️ $alert_msg" ``` ### Technical Analysis Configuration values and remote quote values are inserted directly into AWK source code inside double-quoted shell strings. They are therefore parsed as AWK expressions rather than treated strictly as data. AWK implementations provide executable functions such as `system()`. A malicious value can consequently introduce an additional expression that invokes an operating ...[truncated 2070 chars]- Remediation
View remediation
rhs + 0) }'; then alerts+=("price ${price} crossed above ${price_above}") fi ``` 3. Apply the same pattern to `alert_pct`, `price_below`, and every sign comparison involving `change_pct`. 4. Reject invalid configuration at startup instead of silently passing malformed values into alert logic. 5. Validate the API response schema with `jq`, including the type and allowed numeric format of every quote field, before using it. 6. Run the Skill under a dedicated, minimally privileged account with access only to its configuration and required credentials. This limits impact if another injection defect is introduced. ]]>