T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:85- Finding
Shell Command Injection Through User-Controlled JSONL Content
- Content
View full analysis
> "$DATA_DIR/invitations.jsonl" ``` The same unsafe construction is demonstrated with conversation-derived record content at `SKILL.md`, lines 362-364. ### Technical Analysis The Skill mandates appending JSONL records by constructing a Bash `printf` command in which the JSON document is represented as a single-quoted shell argument. Record properties such as the target alias, invitation content, reaction, scene, summary, and notes can originate from user-controlled conversation text. JSON escaping and shell escaping are separate operations. A single quote in a user-controlled field cannot be safely represented inside the documented single-quoted shell argument without additional shell-aware encoding. If the Agent interpolates a field directly into this command, an attacker can terminate the quoted argument and append arbitrary shell syntax. For example, a malicious record field shaped like the following can break out of the intended argument: ```text '; arbitrary_command; # ``` The vulnerability applies to every JSONL persistence path that follows this mandated pattern, including invitation, interaction, conversation, and review records. ### Attack Path 1. An attacker supplies a social-coaching record containing a single quote followed by shell metacharacters and a command. 2. The Agent constructs the required JSON object using the attacker-controlled value. 3. Following the Skill instructions, the Agent places that JSON directly inside the single-quoted Bash `printf` command. 4. The single quote terminates the intended shell argument. 5. The shell interprets the remaining attacker-controlled text as command syntax. 6. The injected command executes with the same operating-system privileges and filesystem access as the Agent process. ### Im ...[truncated 507 chars]- Remediation
View remediation