T09 · Insecure Skill Coding Practices
Error
- Location
- bootstrap.ts:199
- Finding
- Shell Command Injection Through Workspace-Derived Agent Name<![CDATA[ ## Vulnerability Details **File Location**: `bootstrap.ts:199-205, 247-254` **Vulnerability Type**: OS command injection through unsafe shell interpolation **Risk Level**: High ### Vulnerable Code ```ts function deriveAgentName(configDir: string): string { const parent = basename(dirname(configDir)); if ( parent && parent !== '.' && parent !== '.agentbnb' && parent !== homedir().split('/').pop() ) { return parent; } return `agent-${randomUUID().slice(0, 8)}`; } ``` ```ts const env = { ...process.env, AGENTBNB_DIR: configDir }; const agentName = deriveAgentName(configDir); try { await deps.runCommand( `${quotedCliPath} init --owner "${agentName}" --yes --no-detect`, env ); } ``` The command is ultimately passed to: ```ts export async function runCommand( cmd: string, env: Record<string, string | undefined> ): Promise<{ stdout: string; stderr: string }> { return execAsync(cmd, { env }); } ``` ### Technical Analysis `config.agentDir` or `config.workspaceDir` can influence `configDir`. The basename of that path becomes `agentName`, which is inserted directly into a shell command inside double quotes. Double quotes do not neutralize command substitution. Shell constructs such as `$(command)` and backtick substitutions remain executable. Although the CLI path is escaped by `quoteShellArg()`, the derived agent name is not shell-escaped or restricted to a safe character set. Because `node:child_process.exec()` launches a shell, a malicious workspace or agent directory name can alter the command executed during first-time onboarding. ### Attack Path 1. An attacker causes the plugin to activate with an attacker-controlled `workspaceDir` or `agentDir`. 2. The relevant parent directory has a name containing shell syntax, such as `agent-$(malicious-command)`. 3. No AgentBnB configuration exists, causing automatic onboarding. 4. `deriveAgentName()` returns the malicious directory basename. 5. The value is ...[truncated 576 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace `exec()` with `execFile()` or `spawn()` using an argument array: ```ts await execFileAsync( cliPath, ['init', '--owner', agentName, '--yes', '--no-detect'], { env } ); ``` - Validate derived owner names with a restrictive allowlist, such as: ```ts if (!/^[A-Za-z0-9._-]+$/.test(agentName)) { throw new AgentBnBError('Invalid agent name', 'INIT_FAILED'); } ``` - Do not use directory names as trusted command arguments without validation. - Add regression tests containing `$()`, backticks, quotes, semicolons, newlines, and shell metacharacters. - Avoid shell command construction throughout onboarding, even when individual arguments appear quoted. ]]>