T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:35
- Finding
- Shell Command Injection Through Unsafe User-Input Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 35 and 77 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash # SKILL.md:35 curl -s "http://ip-api.com/json/{IP}?lang=zh-CN&fields=status,message,country,regionName,city,isp,org,as,query,mobile,proxy,hosting" ``` ```bash # SKILL.md:77 curl -s "https://ipinfo.io/{IP}/json" ``` ### Technical Analysis The Skill accepts user-provided IPv4 addresses, IPv6 addresses, and domain names, then instructs the Agent to substitute that input directly into shell command templates. Placing the value inside double quotes does not make the operation safe. Shell constructs such as `$(command)` and backtick command substitutions remain active inside double-quoted strings. If an Agent constructs and executes these commands through a shell without validating the lookup value first, attacker-controlled shell expressions can be evaluated before `curl` starts. The execution flow mentions input validation, but the Skill does not define an enforceable validation algorithm, an allowlist, escaping requirements, or a shell-free execution mechanism. ### Attack Path 1. An attacker asks the Agent to look up a crafted value containing shell syntax, such as a command substitution embedded where a domain name is expected. 2. The Agent replaces `{IP}` with the supplied value in the documented command. 3. The Agent passes the resulting command to a shell. 4. The shell evaluates the command substitution despite the surrounding double quotes. 5. The injected command executes locally before or while `curl` is invoked. Successful exploitation depends on the Agent performing literal interpolation and executing the generated string through a shell. ### Impact Assessment Successful exploitation permits arbitrary command execution with the operating-system privileges of the Agent or Skill runtime. Depending on those privileges and the surrounding environment, an attacker could: ...[truncated 528 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse input as data rather than inserting it into a shell command string. 2. Use a shell-free process API with an argument array, ensuring the lookup value is passed as one literal argument. 3. Strictly validate each supported input type: - Parse IPv4 and IPv6 values with a standard IP-address library. - Validate hostnames against DNS length and character rules. - Reject shell metacharacters, whitespace, URL delimiters, control characters, and values that do not fully match the expected input grammar. 4. Construct URLs with a URL-building library and percent-encode path or query components. 5. Do not treat quoting or ad hoc escaping as a substitute for structural validation. 6. Add explicit negative test cases for values containing `$()`, backticks, semicolons, pipes, redirects, newlines, and quote characters. 7. Document that Agents must not invoke these templates through `sh -c`, `bash -c`, or equivalent shell-evaluation interfaces. ]]>