T09 · Insecure Skill Coding Practices
- Location
bin/tldr-cmd:34- Finding
Untrusted Command Execution Through the Help Fallback
- Content
View full analysis
Vulnerability Details
File Location:
bin/tldr-cmd, lines 34–37
Vulnerability Type: Untrusted local executable invocation
Risk Level: Mediumbash # 2) fallback to --help if [[ -z "$about" && -z "$usage" ]] && command -v "$cmd" >/dev/null 2>&1; then help="$("$cmd" --help 2>&1 || true)" if [[ -n "$help" ]]; thenTechnical Analysis
The script accepts its first argument as
cmdand, when no useful manual-page content is found, resolves and executes that value with--help. Although"$cmd"is quoted and therefore does not permit ordinary shell metacharacter injection, it can still identify an attacker-controlled executable through either a supplied path or a manipulatedPATH.command -vonly verifies that the input resolves to something the shell can invoke; it does not establish that the executable is trusted or that invoking it with--helpis safe. The--helpoption is merely a convention, and an executable can perform arbitrary actions before, during, or instead of printing help text.This behavior also conflicts with the statement in
SKILL.mdthat the Skill “does not run the command,” potentially causing callers to treat untrusted command input as harmless.Attack Path
- An attacker creates a malicious executable and makes it accessible at a known path, or places it earlier in the invoking process's
PATH. - The attacker or another untrusted input source causes the Skill to receive that executable's path or command name as its first argument.
- If no usable manual-page summary is obtained, the fallback condition is reached.
command -v "$cmd"successfully resolves the malicious executable.- The script invokes the executable as
"$cmd" --help. - The executable performs attacker-defined actions with the privileges and environment of the user running the Skill.
Impact Assessment
Successful exploitation provides arbitrary local code execution under th ...[truncated 450 chars]
- An attacker creates a malicious executable and makes it accessible at a known path, or places it earlier in the invoking process's
- Remediation
View remediation
Remediation Suggestions
- Remove the executable fallback and generate summaries exclusively from non-executing sources such as trusted local manual-page data. This is the safest option and makes implementation behavior consistent with the documentation.
- If executable fallback is essential, clearly document that the target program will be executed and require explicit user confirmation before doing so.
- Reject absolute paths, relative paths, values containing
/, option-like input beginning with-, and command names outside a conservative allowlist or validation pattern. - Resolve commands only from administrator-controlled directories rather than relying on the caller's unrestricted
PATH. Construct a minimal trusted environment before resolution and execution. - Execute the fallback in a constrained sandbox with no unnecessary filesystem access, credentials, sensitive environment variables, or network access.
- Apply a short execution timeout and output-size limit to reduce denial-of-service risks from commands that hang or produce unbounded output.
- Prefer a curated allowlist of known commands whose help behavior has been reviewed. Do not treat
--helpas a guarantee that execution is side-effect free. - Update
SKILL.mdso its stated behavior accurately reflects any remaining command execution.