T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:261- Finding
Arbitrary Command Execution Through Crafted Git Filenames
- Content
View full analysis
/dev/null | awk '$1>1048576{print $2}') ``` ### Technical Analysis The output of `git diff --cached --name-only` consists of repository-controlled filenames. Each filename is substituted directly into a command string interpreted by `sh -c`. Quoting the placeholder as `"{}"` does not make this safe. A crafted filename containing quotation marks, command substitutions, shell operators, or other metacharacters can break out of the intended argument context and introduce additional shell commands. Because `sh -c` reparses the generated string as shell syntax, the filename is treated as executable input rather than as an opaque path. The pipeline also uses newline-delimited filename processing. Git permits filenames containing spaces, tabs, newlines, quotes, and shell metacharacters, so both `git diff --name-only` and `xargs` can parse legitimate or hostile filenames incorrectly. ### Attack Path 1. An attacker creates a Git repository or contributes a change containing a file with a maliciously crafted filename. 2. The victim checks out the repository and stages the file, or receives it already present in the repository history and stages a related change. 3. The victim or AI Agent follows the documented pre-commit workflow and executes the large-file check. 4. `git diff --cached --name-only` emits the attacker-controlled filename. 5. `xargs` substitutes that filename into the command passed to `sh -c`. 6. The shell interprets injected metacharacters or substitutions and executes attacker-supplied commands. No elevated privilege is inherently acquired, but the injected command runs with all privileges and environmental access of the user or Agent executing the Skill. ### Impact Assessment Successful expl ...[truncated 688 chars]- Remediation
View remediation