T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:91- Finding
Unescaped External Identifiers in Shell and Query Templates
- Content
View full analysis
","includeOnCallSchedules":true,"includeDependsOn":true,"includeCustomFields":true}' ``` Confirmed service names are inserted into JSM alert-search syntax: ```bash twg jsm alert query --query 'status = open AND (message: ** OR message: **)' \ --limit 30 --site hello -o json --agent-fields @evidence ``` Service names are interpolated into a SQL string embedded inside shell-quoted JSON: ```bash is tools call reliability_insights_execute_socrates_query --cloud-id "$ATLASSIAN_CLOUD_ID" \ --args '{"query":"SELECT alert_id, message, priority, status, integration_name, created_utc FROM production.sre_incident.opsgenie_alerts WHERE day_of_created >= DATE_SUB(CURRENT_DATE(), 14) AND lower(message) LIKE '"'"'%%'"'"' ORDER BY created_utc DESC LIMIT 20"}' ``` Service names are also inserted into delegated Slack searches: ```bash twg rovo search " DLQ latency workflow failed production" \ --app slack --updated-since 7d --limit 50 -o json ``` The signal catalog repeats the vulnerable SQL construction: ```sql SELECT alert_id, message, priority, status, integration_name, created_utc, count FROM production.sre_incident.opsgenie_alerts WHERE day_of_created >= DATE_SUB(CURRENT_DATE(), 14) AND lower(message) LIKE '%%' ORDER BY created_utc DESC LIMIT 20 ``` It also repeats the alert-query construction ...[truncated 3717 chars]- Remediation
View remediation