T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:19
- Finding
- Shell Command Injection Through Unsafe User-Content Interpolation## Vulnerability Details **File Location**: `SKILL.md`, lines 19 and 24–31 **Vulnerability Type**: Shell command injection **Risk Level**: High ```bash # Ensure directory exists mkdir -p ~/.memo # Generate ISO 8601 timestamp (Local Time) TIMESTAMP=$(date +"%Y-%m-%d %H:%M:%S") # Write to file (Variables populated by Agent) # {{category}} will be the English label identified (e.g., Tech, Work) printf "\n---\n### Timestamp: $TIMESTAMP\nLabel: {{category}}\n\n{{content}}\n" >> ~/.memo/{{category}}.md ``` ### Technical Analysis The Skill directs the Agent to interpolate raw, user-controlled `content` into a shell command executed through the `exec` tool. The content is placed inside a double-quoted shell argument, which does not prevent shell evaluation of command substitution expressions such as `$(command)` or backticks. Consequently, memo content containing a command substitution can be evaluated by the shell before `printf` writes the resulting text. Generated category values are also inserted into the command and destination path without explicit validation, although the instructions nominally limit them to a fixed set. ### Attack Path 1. An attacker invokes the Skill using the documented trigger. 2. The attacker supplies memo content containing shell syntax, such as a command substitution expression. 3. The Agent inserts the raw content into the documented `printf` command. 4. The Agent invokes that command through `exec`. 5. The shell evaluates the injected command substitution before executing `printf`. 6. The injected command runs with the same operating-system privileges and environment access as the Agent process. ### Impact Assessment Successful exploitation permits arbitrary shell command execution under the Agent's account. The attacker could read or modify files accessible to that account, steal credentials or tokens available in files or environment variables, initiate network connections, tamp ...[truncated 188 chars]
- Remediation
- ## Remediation Suggestions - Do not construct shell source code by interpolating user-controlled memo content. - Prefer a dedicated filesystem-writing API that does not invoke a shell. - If `exec` is unavoidable, supply the content through standard input or a safely bound positional parameter to a fixed script rather than embedding it into the command string. - Map the classification result to an immutable allowlist containing only `Tech`, `Work`, `Life`, `Inspiration`, and `Others`. Reject every other value. - Construct the destination path from the validated allowlist value and verify that the resolved path remains under `~/.memo`. - Open the destination file in append mode through a language-level file API and write the timestamp, validated label, and original content as data. - Add tests using content containing `$(...)`, backticks, quotes, newlines, redirection operators, semicolons, and traversal strings to confirm that such input is stored literally and never interpreted by a shell.