T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:105- Finding
Unvalidated Search Result URL Interpolated into a Shell Command
- Content
View full analysis
" | python3 -c " import sys, re html = sys.stdin.read() # Strip tags, get text text = re.sub('<[^>]+>', ' ', html) text = re.sub(r'\s+', ' ', text).strip() print(text[:5000]) " ``` ### Technical Analysis The workflow instructs the agent to replace `` with a URL obtained from web-search results and interpolate it directly into a shell command. The URL is not validated or safely passed as a non-shell argument. If a crafted search result contains quotation marks or shell metacharacters, textual substitution can terminate the quoted `curl` argument and append attacker-controlled shell syntax. Any injected command would execute with the permissions of the account running the agent. The flagged pipeline does not inherently download and execute a remote script: the response body is passed as data to a fixed Python parser rather than evaluated as Python or shell code. The vulnerability instead arises from unsafe construction of the surrounding shell command. The retrieval operation also lacks destination restrictions. Curl supports schemes beyond HTTP and HTTPS, while `-L` follows redirects without validating each destination. A malicious URL or redirect could therefore target local files, loopback services, private-network systems, link-local endpoints, or cloud instance metadata. This network and local-resource access exceeds the minimum privileges required to retrieve public research pages. ### Attack Path 1. An attacker causes an MCP search provider or indexed web page to return a crafted URL. 2. The agent selects that URL as a key research source. 3. The agent substitutes the untrusted value into the documented shell command. 4. One of the following exploitation paths occurs: - Shell syntax in the URL escapes the quoted argument ...[truncated 1105 chars]- Remediation
View remediation