T09 · Insecure Skill Coding Practices
Error
- Location
scripts/precision_picker.py:55- Finding
Shell Command Injection Through Unvalidated Stock Codes
- Content
View full analysis
1 else "" candidates.append({"code": code, "name": name}) ``` The resulting values are directly interpolated into command strings: ```python cmd = f"npx -y westock-data-skillhub@1.0.5 finance {','.join(working_codes)} --num 1" stdout, rc, success = run_cmd(cmd, cwd=str(SKILL_DIR), timeout=90) ``` ```python code_list = ",".join(codes) cmd = f"npx -y westock-data-skillhub@1.0.5 fund flow {code_list}" stdout, rc, success = run_cmd(cmd, cwd=str(SKILL_DIR), timeout=90) ``` These command strings are executed through a shell: ```python def run_cmd(cmd, cwd=None, timeout=60): """Execute a command and return stdout and a success indicator.""" try: result = subprocess.run( cmd, shell=True, capture_output=True, text=True, timeout=timeout, cwd=cwd ) return result.stdout.strip(), result.returncode, True except subprocess.TimeoutExpired: return "", -1, False except Exception: return "", -1, False ``` ### Technical Analysis The code treats stock identifiers as trusted command fragments. No strict allowlist, regular-expression validation, argument escaping, or shell-free process i ...[truncated 2655 chars]- Remediation
View remediation