T09 · Insecure Skill Coding Practices
- Location
SKILL.md:35- Finding
Shell Command Injection Through Unvalidated Location Substitution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 35-40
Vulnerability Type: Shell command injection through user-controlled template substitution
Risk Level: HighVulnerable Code
bash # JSON format for parsing (recommended) curl -s "wttr.in/{LOCATION}?format=j1" # Human-readable 3-day forecast curl -s "wttr.in/{LOCATION}"Technical Analysis
The documented workflow accepts a location supplied by the user and instructs the agent to insert it directly into a shell command. Enclosing the URL in double quotes does not prevent shell expansions such as command substitution using
$(...)or backticks.If the agent replaces
{LOCATION}verbatim and invokes the resulting command through a shell, a crafted location can cause local commands to execute beforecurlruns. Network access is necessary for the Skill, but executing a shell command constructed from untrusted location text is not necessary and exceeds the minimum safe implementation requirements.Attack Path
- An attacker supplies a location containing shell syntax, such as
$(attacker_command). - The agent substitutes that value directly for
{LOCATION}in the documented command. - The command is passed to a shell.
- The shell evaluates the command substitution despite the surrounding double quotes.
- The attacker's command executes locally, after which
curlprocesses the resulting URL.
Exploitation depends on the calling agent performing literal template substitution and executing the generated string through a shell.
Impact Assessment
Successful exploitation provides arbitrary command execution with the same operating-system privileges as the agent or user running the Skill. Depending on those privileges and the host environment, this could permit reading or modifying accessible files, accessing environment variables or credentials, making unauthorized network requests, tampering with project data, or ex ...[truncated 124 chars]
- An attacker supplies a location containing shell syntax, such as
- Remediation
View remediation
Remediation Suggestions
- Do not construct shell command strings by interpolating user-controlled location values.
- Prefer an HTTP client API that accepts the endpoint and query parameters separately and does not invoke a shell.
- If
curlmust be used, invoke it as an argument array rather than through shell evaluation. - Validate locations against a narrowly defined character set and length limit appropriate for city names, country names, and airport codes.
- URL-encode the location as data rather than concatenating it into the URL.
- Reject shell metacharacters and control characters as defense in depth.
- Update the documentation to provide a safe wrapper that receives the location as a positional argument and performs URL encoding internally.