T09 · Insecure Skill Coding Practices
Error
- Location
- references/task_guidelines.md:73
- Finding
- Arbitrary Command Execution Through Sourcing JSON-Derived Shell Code<![CDATA[ ## Vulnerability Details **File Location**: `references/task_guidelines.md:73` **Vulnerability Type**: Shell command injection through dynamically generated shell code **Risk Level**: High ### Vulnerable Code ```bash source <(jq -r '.weekly[] | "task_\(.id)=\(.)"' data/task_rhythm.json) ``` ### Technical Analysis The documented task template converts entries from `data/task_rhythm.json` into shell source code and executes the result in the current shell with `source`. The JSON fields are interpolated into generated shell statements without shell escaping, type validation, or an allowlist. If an attacker can modify a weekly task entry, values containing command substitutions or other shell syntax may become executable when the documented template is used. This violates the data/code separation boundary: configuration data is treated as trusted shell code. Because `source` runs within the current shell rather than a restricted subprocess, injected commands inherit the invoking process's environment, permissions, working directory, and accessible credentials. ### Attack Path 1. An attacker obtains write access to `data/task_rhythm.json`, or supplies a modified configuration that is accepted by the Skill. 2. The attacker inserts shell syntax, such as a command substitution, into a field of a weekly task object. 3. A user or AI Agent follows the task execution template in `references/task_guidelines.md`. 4. `jq` interpolates the malicious field into text intended to represent a shell assignment. 5. `source` parses and executes that generated text in the current shell. 6. The injected command runs with the privileges and environment of the user or Agent executing the template. Exploitation depends on both modification of the configuration and execution of the documented template; the bundled scripts do not invoke this line automatically. ### Impact Assessment Successful exploitation permits arbitrary command execution as the account running the t ...[truncated 703 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove `source` and process substitution from the configuration-loading workflow. - Treat every JSON field as data and extract only the specific required values: ```bash task_id=$(jq -r '.weekly[] | select(.id == 35) | .id' data/task_rhythm.json) task_enabled=$(jq -r '.weekly[] | select(.id == 35) | .enabled' data/task_rhythm.json) ``` - Validate extracted values before use. Require task IDs to match `^[0-9]+$` and enabled states to equal only `true` or `false`. - Store values in explicitly named, quoted shell variables rather than constructing variable names or executable assignment statements dynamically. - Validate the entire JSON document against a strict schema before processing it. Reject unknown fields, incorrect types, and unexpected control characters. - Ensure configuration files are writable only by the trusted owner and are not populated directly from untrusted input. - If dynamic task dispatch is required, map allowed action names to predefined shell functions through a fixed `case` statement. Never evaluate an action field as a command. - Add negative security tests containing command substitutions, semicolons, newlines, redirections, and shell metacharacters to confirm that all values remain non-executable. ]]>