T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:66- Finding
Shell Command Injection and Unsafe Path Handling
- Content
View full analysis
status --porcelain 2>&1 ``` ```bash git -C status --porcelain | grep '^?' | awk '{print $2}' | grep '\.md$' git -C diff --name-only --diff-filter=A HEAD ``` ```bash mv /.md //.md ``` ### Technical Analysis The skill instructs the agent to interpolate the user-provided vault root and discovered or generated path components directly into shell command templates. It does not require shell-safe argument handling, quoting, canonicalization, or validation that the resulting paths remain inside the approved vault. If these templates are executed through a shell, spaces, command separators, command substitutions, redirections, or other shell metacharacters in `vault_root`, `note`, or `topic` can change the meaning of the command. The danger is especially significant because note filenames originate from a user-controlled filesystem. The Git status parser is also unsafe for valid filenames. Parsing porcelain output with `awk '{print $2}'` splits on whitespace, corrupting filenames containing spaces. Git may quote unusual paths, and line-oriented parsing does not safely accommodate all valid filename characters. This can cause incorrect files to be selected or moved even without deliberate command injection. The displayed `mv` command also lacks the `--` end-of-options marker. A path component beginning with a hyphen can consequently be interpreted as an option rather than a filename. ### Attack Path 1. An attacker creates or supplies a vault path or Markdown filename containing shell metacharacters, whitespace, command substitution syntax, or option-like prefixes. 2. The user invokes the skill to organize that vault. 3. The agent s ...[truncated 1258 chars]- Remediation
View remediation