T09 · Insecure Skill Coding Practices
Error
- Location
commands/start.sh:5- Finding
Arbitrary Shell Command Injection Through Task and Target Directory Arguments
- Content
View full analysis
$LOG_FILE 2>&1 & ``` ### Technical Analysis `TARGET_DIR` and the task description in `$1` are expanded while the outer shell constructs a new program for `bash -c`. Single quotation marks included in the expanded values are not escaped before the resulting string is parsed by the child shell. Consequently, an input containing a single quote can terminate the intended quoted argument and append additional shell syntax. Quoting the variables with literal single quotes inside the constructed string does not provide protection because the expansion occurs before `bash -c` parses that string. The vulnerable shell runs independently of Codex. Therefore, the command injection occurs even before Codex applies any interpretation to the task and is not constrained by Codex sandbox settings. ### Attack Path 1. An attacker controls or influences the task description or target directory supplied to `start.sh`. 2. The attacker supplies a value containing a closing single quote, shell commands, and a comment marker. A representative task structure is: ```text '; attacker-command; # ``` 3. The outer shell expands the value into the string passed to `bash -c`. 4. The child shell interprets the injected quotation mark and separators as shell syntax. 5. `attacker ...[truncated 794 chars]- Remediation
View remediation
"$log_file" 2>&1 & ``` Additional hardening should include: 1. Validate that `target_dir` is an existing directory and resolve it with `realpath`. 2. If operation must be restricted to approved workspaces, verify that the canonical path is beneath an allowlisted root. 3. Quote every variable expansion used as an argument or redirection target. 4. Avoid `eval`, `bash -c`, or equivalent reparsing mechanisms for user-controlled data. 5. Add regression tests using task descriptions and paths containing quotation marks, semicolons, command substitutions, whitespace, glob characters, and newlines. 6. Remove the sandbox-bypass flag addressed in the separate finding. ]]>