T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:115- Finding
Command Injection Through Shell-Interpolated Markdown Input
- Content
View full analysis
" [OPTIONS] ``` The documented example follows the same command-string construction pattern: ```bash python ./scripts/edrawmind_cli.py --text "# AI技术\n## 机器学习\n- 监督学习\n- 无监督学习\n## 深度学习\n- CNN\n- Transformer" --layout 1 --theme 2 ``` ### Technical Analysis The Skill instructs the Agent to place generated or user-controlled Markdown directly into a double-quoted shell argument. Double quotes do not suppress shell command substitution. Constructs such as `$(command)` and backticks are evaluated by the shell before `edrawmind_cli.py` starts. Embedded quotation marks can also terminate the intended argument and introduce additional shell syntax. This affects Markdown received directly from a user as well as content extracted from a document or repository. The Python script itself uses `argparse` and does not invoke a shell. The vulnerability arises from the execution method prescribed by the Skill documentation. ### Attack Path 1. An attacker supplies Markdown containing a shell substitution, such as a node whose text includes `$(attacker_command)`. 2. The Agent follows Step 6 of `SKILL.md` and interpolates the Markdown into the documented double-quoted command. 3. The command is submitted to a shell-based execution tool. 4. The shell evaluates the injected substitution before launching Python. 5. The attacker's command executes with the same operating-system permissions as the Agent process. 6. The Python CLI may subsequently receive only the output of that command, making the injection less apparent in the generated mind map. ### Impact Assessment Successful exploitation provides arbitrary command execution under the Agent's local user account. The attacker could: - Read files accessible to the Agent. - Exfiltrate local cr ...[truncated 464 chars]- Remediation
View remediation