T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:41
- Finding
- Shell Command Injection Through Unsafe Parameter Interpolation in curl Templates<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 41–47 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```markdown ## Command templates (exec tool + curl) - Generate: - `curl -sS -X POST "http://127.0.0.1:8010/api/material/generate" -H "Content-Type: application/json" -d '{"job_id":"<job_id>","resume_version":"resume_v1"}'` - Review: - `curl -sS -X POST "http://127.0.0.1:8010/api/material/review" -H "Content-Type: application/json" -d '{"thread_id":"<thread_id>","decision":"approve"}'` - Export: - `curl -sS -X POST "http://127.0.0.1:8010/api/material/export" -H "Content-Type: application/json" -d '{"thread_id":"<thread_id>","format":"pdf"}'` ``` ### Technical Analysis The Skill instructs the Agent to invoke an execution tool with shell-formatted `curl` commands. The `job_id` and `thread_id` placeholders are placed directly inside single-quoted shell arguments without validation or shell-safe encoding. The `job_id` value may be supplied directly by a user. The `thread_id` value is obtained from a local API response and therefore crosses a separate trust boundary. If either value contains a single quote, it can terminate the surrounding shell argument. Additional shell operators and commands can then be introduced before the remainder of the command is neutralized, for example using a comment operator. JSON quoting does not protect values from shell interpretation. The shell parses and expands the command before `curl` receives the JSON body. Using a JSON serializer alone is also insufficient if the resulting JSON is subsequently concatenated into a shell command string. The vulnerability is exploitable when the Agent follows these templates by replacing placeholders in a command string and passes that string to a shell-based execution tool. ### Attack Path 1. An attacker supplies a crafted `job_id` containing a single quote followed by shell syntax. Alternatively, a compromised or ...[truncated 1470 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Avoid shell command construction** - Use a structured HTTP client tool that accepts the URL, headers, and JSON body as separate typed fields. - Prefer a process API that accepts an argument array and does not invoke a shell. 2. **Serialize JSON safely** - Build request bodies using a proper JSON serializer rather than textual placeholder replacement. - If command-line `curl` is unavoidable, write serialized JSON to standard input and invoke `curl` through an argument-array API with `--data-binary @-`. 3. **Do not evaluate generated command strings** - Never pass interpolated values to `sh -c`, `bash -c`, `eval`, or an equivalent shell execution mechanism. - Do not rely solely on backslash escaping because correct escaping depends on the shell and execution context. 4. **Validate identifiers** - Enforce a strict allowlist for `job_id` and `thread_id`, based on their documented formats. - If identifiers are intended to be simple opaque tokens, reject values that do not match a restrictive expression such as `^[A-Za-z0-9_-]+$`. - Apply length limits and reject control characters, quotes, whitespace, and shell metacharacters. 5. **Treat API responses as untrusted** - Validate `thread_id` and all other response fields before displaying or reusing them. - Do not assume that a loopback service is inherently trustworthy, because another local process may be able to replace, compromise, or influence it. 6. **Reduce execution privileges** - Run the Agent and HTTP workflow in a sandbox with minimal filesystem and network access. - Prevent access to unrelated credentials and sensitive directories. ]]>