T09 · Insecure Skill Coding Practices
Error
- Location
- workflows/white-space.md:65
- Finding
- Command Injection Through Unsafe Shell Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `workflows/white-space.md:65-75`; `workflows/white-space-phase3.md:25-47` **Vulnerability Type**: Shell command injection through unvalidated and improperly encoded input **Risk Level**: High ### Vulnerable Code `workflows/white-space.md:65-75`: ```bash WORKDIR=$(mktemp -d) API="https://api-production.alphalens.ai" curl -s -H "API-Key: $KEY" "$API/api/v1/entities/organizations/by-domain/{domain}" # → get organization_id, active_domain, logo_url ``` `workflows/white-space-phase3.md:25-47`: ```bash # Full combo (A+B+C — anchor's full feature set) curl -s -H "API-Key: $KEY" "$API/api/v1/search/products/search?description={feature_A}%20{feature_B}%20{feature_C}&limit=50&is_headquarters=true" > $WORKDIR/p1_abc.json & # Omit A (B+C) curl -s -H "API-Key: $KEY" "$API/api/v1/search/products/search?description={feature_B}%20{feature_C}&limit=50&is_headquarters=true" > $WORKDIR/p1_bc.json & # Omit B (A+C) curl -s -H "API-Key: $KEY" "$API/api/v1/search/products/search?description={feature_A}%20{feature_C}&limit=50&is_headquarters=true" > $WORKDIR/p1_ac.json & # Omit C (A+B) curl -s -H "API-Key: $KEY" "$API/api/v1/search/products/search?description={feature_A}%20{feature_B}&limit=50&is_headquarters=true" > $WORKDIR/p1_ab.json & # Swap: replace C with new feature D curl -s -H "API-Key: $KEY" "$API/api/v1/search/products/search?description={feature_A}%20{feature_B}%20{feature_D}&limit=50&is_headquarters=true" > $WORKDIR/p1_abd.json & wait ``` ### Technical Analysis The workflows direct an agent to substitute domain and feature values directly into shell command templates. The initial domain originates from the user, while the feature-swap workflow explicitly permits the user to provide `feature_D`. No mandatory domain validation or URL-encoding operation is specified before generating the shell source. Double quotes do not prevent shell command substitution. If an agent reproduces an attacker-controlled value ...[truncated 1735 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Never construct executable shell source by directly replacing placeholders with user-controlled text. 2. Validate domains with a strict allowlist before use. Accept only normalized public DNS names and reject whitespace, control characters, URL schemes, paths, ports, and shell metacharacters. 3. Pass dynamic values as positional arguments or environment variables rather than embedding them into generated commands. 4. Use curl's encoding support for query values: ```bash curl --fail-with-body --silent --show-error --get \ -H "API-Key: $KEY" \ --data-urlencode "description=$FEATURE_QUERY" \ --data "limit=50" \ --data "is_headquarters=true" \ "$API/api/v1/search/products/search" ``` 5. For domain resolution, validate and URL-encode the path component using a trusted language or library before invoking curl. 6. Add an explicit rule that agents must not copy raw user input into shell commands. 7. Quote temporary paths consistently, for example: ```bash > "$WORKDIR/p1_abc.json" ``` 8. Add adversarial tests covering command substitutions, backticks, quotes, newlines, ampersands, semicolons, Unicode separators, and percent-encoded control characters. ]]>