T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:42
- Finding
- Shell Command Injection Through Unsafe curl Command Templates## Vulnerability Details **File Location**: `SKILL.md`, lines 42–46 **Vulnerability Type**: Shell command injection caused by unsafe interpolation of untrusted values **Risk Level**: High **Vulnerable Code**: ```sh curl -sS -X POST "http://127.0.0.1:8010/api/form/fill/start" -H "Content-Type: application/json" -d '{"url":"<target_url>","profile":{"name":"<name>","email":"<email>"},"max_actions":20}' curl -sS -X POST "http://127.0.0.1:8010/api/form/fill/review" -H "Content-Type: application/json" -d '{"thread_id":"<thread_id>","decision":"approve","max_actions":20}' curl -sS -X POST "http://127.0.0.1:8010/api/form/fill/review" -H "Content-Type: application/json" -d '{"thread_id":"<thread_id>","decision":"reject"}' ``` ### Technical Analysis The skill instructs an agent to execute shell-based `curl` templates and substitute user-controlled or API-derived values directly into a single-quoted JSON argument. A value containing a single quote can terminate the shell quoting context. Subsequent shell metacharacters can then introduce additional commands. The affected inputs include the target URL, profile name, email address, and thread identifier. The first three may be supplied directly by a user. The thread identifier is returned by the local API and must also be treated as untrusted because the integrity of that service and its responses is not established by the skill. Escaping values only for JSON is insufficient because JSON and shell parsing are separate interpretation layers. Values must not be concatenated into a command string interpreted by a shell. ### Attack Path 1. An attacker supplies a target URL or profile value containing a single quote followed by shell syntax. 2. The agent replaces a placeholder in the documented command template with the attacker-controlled value. 3. The inserted single quote closes the intended `-d` argument. 4. The shell interprets the remaining injected ...[truncated 968 chars]
- Remediation
- ## Remediation Suggestions - Do not interpolate untrusted values into shell command strings. - Prefer a native HTTP client or structured tool that accepts the HTTP method, URL, headers, and body as separate parameters without invoking a shell. - Construct request bodies with a proper JSON serializer so quotation marks, control characters, and Unicode data are encoded correctly. - If `curl` must be used, invoke it through an argument-vector API with shell parsing disabled. Supply serialized JSON through standard input or a securely created file rather than concatenating it into a shell expression. - Strictly validate target URLs, allowing only required schemes such as `https`, while also applying appropriate restrictions against internal or otherwise prohibited destinations. - Treat API-returned thread identifiers as untrusted opaque data. Validate them against a narrow documented format, such as a UUID, before reuse. - Avoid logging full profile bodies or generated commands because they may contain personal information. - Add tests containing single quotes, quotation marks, command metacharacters, line breaks, and malformed identifiers to verify that inputs remain data and cannot alter command structure.