T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:105
- Finding
- Unvalidated Search Result URL Interpolated into a Shell Command<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 105-112 **Vulnerability Type**: Command injection and unrestricted resource retrieval **Risk Level**: High ### Vulnerable Code ```bash curl -sL "<url>" | python3 -c " import sys, re html = sys.stdin.read() # Strip tags, get text text = re.sub('<[^>]+>', ' ', html) text = re.sub(r'\s+', ' ', text).strip() print(text[:5000]) " ``` ### Technical Analysis The workflow instructs the agent to replace `<url>` with a URL obtained from web-search results and interpolate it directly into a shell command. The URL is not validated or safely passed as a non-shell argument. If a crafted search result contains quotation marks or shell metacharacters, textual substitution can terminate the quoted `curl` argument and append attacker-controlled shell syntax. Any injected command would execute with the permissions of the account running the agent. The flagged pipeline does not inherently download and execute a remote script: the response body is passed as data to a fixed Python parser rather than evaluated as Python or shell code. The vulnerability instead arises from unsafe construction of the surrounding shell command. The retrieval operation also lacks destination restrictions. Curl supports schemes beyond HTTP and HTTPS, while `-L` follows redirects without validating each destination. A malicious URL or redirect could therefore target local files, loopback services, private-network systems, link-local endpoints, or cloud instance metadata. This network and local-resource access exceeds the minimum privileges required to retrieve public research pages. ### Attack Path 1. An attacker causes an MCP search provider or indexed web page to return a crafted URL. 2. The agent selects that URL as a key research source. 3. The agent substitutes the untrusted value into the documented shell command. 4. One of the following exploitation paths occurs: - Shell syntax in the URL escapes the quoted argument ...[truncated 1105 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not construct shell commands through textual URL interpolation. Use a dedicated HTTP client or invoke curl through an argument-array API that bypasses shell parsing. 2. Permit only explicitly required schemes, preferably `https`; allow `http` only if there is a documented operational need. 3. Parse and validate each URL before retrieval. Reject embedded credentials, control characters, malformed hosts, shell metacharacters, and unsupported schemes. 4. Resolve hostnames and block loopback, link-local, private, multicast, unspecified, and reserved address ranges for both IPv4 and IPv6. 5. Disable redirects where possible. If redirects are required, apply the complete scheme, hostname, DNS, and IP validation process to every redirect target. 6. Apply strict connection, transfer, and overall timeouts, as well as a maximum response size. 7. Use curl hardening options where curl remains necessary, including explicit protocol restrictions such as `--proto '=https'` and redirect-protocol restrictions such as `--proto-redir '=https'`. 8. Treat all fetched content as untrusted data. Explicitly instruct the agent not to execute commands or follow operational instructions contained in retrieved pages. 9. Run the retrieval component in a sandbox with minimal filesystem permissions, no unnecessary credentials, and restricted outbound network access. ]]>