T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:32- Finding
Shell Command Injection Through Unquoted User-Controlled Arguments
- Content
View full analysis
--period <周期> --count <数量> ``` ```bash python3 {baseDir}/tools/indicator_engine.py --symbol <代码> --indicators <指标列表> ``` ```bash python3 {baseDir}/tools/pattern_recognizer.py --symbol <代码> --period daily ``` ```bash python3 {baseDir}/tools/trend_analyzer.py --symbol <代码> ``` ```bash python3 {baseDir}/tools/volume_analyzer.py --symbol <代码> ``` ```bash python3 {baseDir}/tools/chart_generator.py --symbol <代码> --type comprehensive --output /tmp/chart.png ``` ### Technical Analysis The Skill instructs the agent to invoke these commands through an `exec` tool while directly substituting stock symbols, periods, indicator lists, and related user-controlled values into shell command strings. The documented commands do not quote the substituted values or require strict validation before execution. If the `exec` implementation invokes a shell, metacharacters embedded in a supplied stock symbol or another argument can terminate or alter the intended command and introduce an additional command. Python `argparse` validation does not mitigate this issue because shell interpretation occurs before the Python process receives its arguments. Market-specific stock identifiers have narrow, predictable formats, but the Skill does not prescribe an allowlist or reject unexpected characters. ### Attack Path 1. An attacker submits a technical-analysis request containing a crafted stock symbol or other command argument with shell control characters. 2. The agent substitutes the attacker-controlled value into one of the command templates in `SKILL.md`. 3. The agent passes the resulting string to the shell-backed `exec` tool. 4. The shell interprets the injected metacharacters and executes an additional attacker-selected command. 5. The injected co ...[truncated 751 chars]- Remediation
View remediation