T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:13
- Finding
- Shell Command Injection Through Unsanitized Location Input## Vulnerability Details **File Location**: `SKILL.md`, lines 13-43 **Vulnerability Type**: Shell command injection **Risk Level**: High **Vulnerable Code**: ```markdown For any weather query, run the matching curl command below. Replace `CITY` with the user's location. ### Current Weather ```bash curl.exe -s "https://api.openmeteo-api.com/api/current?location=CITY" ``` ### Multi-Day Forecast ```bash curl.exe -s "https://api.openmeteo-api.com/api/forecast?location=CITY&days=5" ``` ### Air Quality ```bash curl.exe -s "https://api.openmeteo-api.com/api/air-quality?location=CITY" ``` ### UV Index ```bash curl.exe -s "https://api.openmeteo-api.com/api/uv?location=CITY" ``` ### Severe Weather Alerts ```bash curl.exe -s "https://api.openmeteo-api.com/api/alerts?location=CITY" ``` ### Quick One-Liner ```bash curl.exe -s "https://api.openmeteo-api.com/api/quick?location=CITY" ``` ``` ### Technical Analysis The instructions require the agent to replace `CITY` directly with a user-provided location and execute the resulting command through a shell. No validation, shell escaping, or URL encoding is required. Placing the location inside double quotes does not make this construction safe. On POSIX-compatible shells, command substitutions using `$(...)` or backticks are still evaluated inside double-quoted strings. Shell-specific metacharacters may also create additional exploitation opportunities depending on how the agent constructs and invokes the final command. For example, a location containing `$(id)` could result in the shell executing `id` before `curl` is invoked. The command output would then be inserted into the URL. More damaging commands could read files, alter workspace content, or execute downloaded programs. ### Attack Path 1. An attacker submits a weather request containing a location with shell syntax, such as `London$(malicious_command)`. 2. The agent follows ...[truncated 959 chars]
- Remediation
- ## Remediation Suggestions - Do not construct executable shell commands through textual replacement. - Pass the location as a distinct argument through a process-execution API that does not invoke a shell. - Use `curl` parameter encoding rather than placing raw input into the URL: ```bash curl --silent --get \ --data-urlencode "location=$CITY" \ "https://api.openmeteo-api.com/api/current" ``` - Populate `CITY` through a safe argument or environment mechanism rather than embedding a user string into shell source. - Reject control characters and unexpected input lengths before invocation. - Apply equivalent safe parameter handling to every endpoint, including the `days` and `units` parameters. - Prefer a native HTTP client with structured query-parameter support over shelling out to `curl`.