T09 · Insecure Skill Coding Practices
Error
- Location
- index.js:43
- Finding
- Shell Command Injection and Refresh Token Exposure Through Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `index.js:43-52` **Vulnerability Type**: OS command injection and insecure credential handling **Risk Level**: High ### Vulnerable Code ```javascript async function execPython(args) { const token = getEnvToken(); if (!token) throw new Error('ALIYUN_DRIVE_REFRESH_TOKEN not found in .env'); const envPath = resolve(process.cwd(), '.env'); const python = findPython(); const cmd = [python, PYTHON_SCRIPT, ...args, '--token', token, '--save-token', envPath]; const { execSync } = require('child_process'); const output = execSync(cmd.join(' '), { encoding: 'utf8', timeout: 120000, stdio: ['pipe', 'pipe', 'pipe'] }); return JSON.parse(output.trim()); } ``` ### Technical Analysis The function constructs a command by joining an array into a single shell command string and passes that string to `execSync`. Several elements of `args` originate from Skill input, including file paths, folder names, search terms, parent IDs, and file IDs. These values are neither validated nor shell-escaped. Because string-form `execSync` executes through a shell, shell metacharacters in any attacker-controlled argument can terminate or modify the intended command and introduce additional commands. Quoting is not applied even for legitimate paths containing spaces, which also makes normal execution unreliable. The Aliyun Drive refresh token is appended directly to the command line as `--token`. This unnecessarily exposes a long-lived credential to process-command-line inspection and may include it in diagnostic output or process-monitoring logs. It also means shell metacharacters contained in the token can affect command parsing. ### Attack Path 1. An attacker or untrusted caller invokes an action accepting a string argument, such as `create_folder`, `search`, or `upload`. 2. The attacker places shell syntax in the argument, for example a folder name containing `; attacker-command #`. 3. The action handler appends ...[truncated 1026 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace shell-string execution with argument-vector execution: ```javascript import { execFileSync } from 'node:child_process'; const output = execFileSync( python, [PYTHON_SCRIPT, ...args, '--save-token', envPath], { encoding: 'utf8', timeout: 120000, stdio: ['pipe', 'pipe', 'pipe'], shell: false, env: { ...process.env, ALIYUN_DRIVE_REFRESH_TOKEN: token } } ); ``` - Read the token from a protected environment variable or standard input in Python instead of passing it in `argv`. - Never interpolate user-controlled values into a shell command. - Validate file and folder IDs against the expected Aliyun Drive identifier format. - Validate folder names and search terms for length and allowed characters. - Resolve upload paths and enforce an explicit allowlist of directories that the Skill is permitted to upload from. - Use native ES module imports for `child_process` rather than `require()` in a package configured with `"type": "module"`. - Ensure errors returned to callers do not include commands, credentials, or sensitive subprocess output. ]]>