T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:118- Finding
User-Controlled Reminder Content Is Promoted to a Main-Session System Event
- Content
View full analysis
< \" or dangerous commands" exit 1 fi SESSION_INFO=$(session_status) AGENT=$(echo "$SESSION_INFO" | jq -r '.deliveryContext.accountId') TO=$(echo "$SESSION_INFO" | jq -r '.deliveryContext.to') REMIND_AT=$(date -u -d "$USER_TIME" +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null) if [ -z "$REMIND_AT" ]; then echo "Error: unable to parse time '$USER_TIME'" echo "Supported formats: 30s/5m/2h/1d or 3pm/today 15:00" exit 1 fi NOW=$(date -u +"%Y-%m-%dT%H:%M:%SZ") if [[ "$REMIND_AT" < "$NOW" ]]; then echo "Error: reminder time must be in the future" exit 1 fi JOB_ID=$(skill-platform cron add \ --name "reminder-$(date +%s)" \ --at "$REMIND_AT" \ --session main \ --system-event "$TASK_CONTENT" \ --agent "$AGENT" \ --announce \ --channel "$CHANNEL" \ --to "$TO" \ --delete-after-run \ --output json | jq -r '.id') ``` The associated validation is a shell-oriented blacklist: ```bash CONTENT="$1" if [[ "$CONTENT" =~ \$\(.*\) ]] || [[ "$CONTENT" =~ '`' ]]; then echo "Reject: contains command substitution" exit 1 fi if [[ "$CONTENT" =~ [;\|&\>\<] ]]; then echo "Reject: contains shell metacharacters" exit 2 fi if [[ "$CONTENT" =~ [\"] ]]; then echo "Reject: contains double quotes" exit 3 fi if [[ "$CONTENT" =~ $'\n' ]]; then echo "Reject: contains a newline" exit 4 fi DANGEROUS=("sudo" "rm " "wget " "curl " "bash " "sh " "chmod " "chown ") for cmd in "${DANGEROUS[@]}"; do if [[ "$CONTENT" =~ ^$cmd ]] || [[ ...[truncated 3957 chars]- Remediation
View remediation