T09 · Insecure Skill Coding Practices
- Location
SKILL.md:156- Finding
Command Injection Through Unsanitized Skill Identifier
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 156–171
Vulnerability Type: Shell command injection caused by unsafe interpolation
Risk Level: HighVulnerable Code
text 1. Extract owner and name from $ARGUMENTS 2. Expected format: owner/name 3. If $ARGUMENTS is empty or lacks a slash separator, request new input 4. Trim surrounding whitespace and reject the input if either component is emptybash curl -s "https://scanner.pyxmate.com/api/v1/check/{owner}/{name}"Technical Analysis
The documented validation only verifies that the input contains a slash and that the resulting components are nonempty. It does not enforce a safe character set for
ownerandname.The fallback then instructs the Agent to interpolate these attacker-controlled values into a shell command. Double quotes do not prevent shell command substitution. Consequently, input containing constructs such as
$(command)or backticks may be evaluated by the shell beforecurlexecutes.For example, an identifier shaped like
owner/$(id)can satisfy the documented slash and nonempty checks. If directly substituted into the fallback command, the shell executesidand places its output into the URL. More harmful commands could read files, change local data, invoke other programs, or initiate additional network requests.This issue concerns the curl fallback specifically. The declared request to
scanner.pyxmate.comis necessary for the Skill's API-based scanning function, and the reviewed content does not instruct the Agent to transmit credentials or local files. However, successful command injection could exceed that intended network-only privilege boundary.Attack Path
- An attacker persuades a user or Agent to scan a crafted Skill identifier containing shell substitution syntax.
- The crafted value contains a slash and nonempty components, so it passes the documented validation.
- WebFetch ...[truncated 1403 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer a structured HTTP request tool that accepts the URL and path parameters as data without invoking a command shell.
- Strictly validate both identifier components before any network request. A conservative allowlist such as
^[A-Za-z0-9._-]+$should be applied independently toownerandname. - Reject shell metacharacters, whitespace, control characters, additional path separators, command substitutions, quotes, and encoded path traversal sequences.
- URL-encode each validated path segment using a trusted URL library rather than string concatenation.
- If curl remains necessary, invoke it through an argument-array API without a shell. Do not construct a command string and pass it to
sh,bash,cmd.exe, PowerShell, or an equivalent interpreter. - Add explicit instructions prohibiting direct interpolation of
$ARGUMENTSor model-generated values into shell commands. - Run the Skill with least privilege: restrict filesystem access, remove unnecessary credentials from the environment, and limit outbound traffic to the declared scanning service.
- Add negative tests for inputs containing
$(...), backticks, quotes, semicolons, pipes, ampersands, newlines, extra slashes, traversal sequences, and percent-encoded metacharacters.