T09 · Insecure Skill Coding Practices
Error
- Location
bootstrap.ts:199- Finding
Shell Command Injection Through Workspace-Derived Agent Name
- Content
View full analysis
): Promise<{ stdout: string; stderr: string }> { return execAsync(cmd, { env }); } ``` ### Technical Analysis `config.agentDir` or `config.workspaceDir` can influence `configDir`. The basename of that path becomes `agentName`, which is inserted directly into a shell command inside double quotes. Double quotes do not neutralize command substitution. Shell constructs such as `$(command)` and backtick substitutions remain executable. Although the CLI path is escaped by `quoteShellArg()`, the derived agent name is not shell-escaped or restricted to a safe character set. Because `node:child_process.exec()` launches a shell, a malicious workspace or agent directory name can alter the command executed during first-time onboarding. ### Attack Path 1. An attacker causes the plugin to activate with an attacker-controlled `workspaceDir` or `agentDir`. 2. The relevant parent directory has a name containing shell syntax, such as `agent-$(malicious-command)`. 3. No AgentBnB configuration exists, causing automatic onboarding. 4. `deriveAgentName()` returns the malicious directory basename. 5. The value is ...[truncated 576 chars]- Remediation
View remediation