T09 · Insecure Skill Coding Practices
- Location
SKILL.md:23- Finding
Shell and JSON Injection Through Unsafe Query Interpolation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 23–31
Vulnerability Type: Unsafely interpolated user input in a shell command
Risk Level: Highbash 1. Construct the query string based on the user's request. 2. Execute the POST request to the Meixiang endpoint: ```bash curl -X POST \ --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/news-search' \ --header 'Content-Type: application/json' \ --header "apikey:${MX_APIKEY}" \ --data '{"query":"<YOUR_QUERY_HERE>"}' ```Technical Analysis
The skill instructs an agent to construct a shell command by replacing
<YOUR_QUERY_HERE>with content derived from the user's request. It does not require the query to be encoded with a JSON serializer or passed to the process through a shell-safe mechanism.The request body is enclosed in a single-quoted shell argument. If an implementation performs direct textual substitution, a query containing a single quote can terminate that argument. Subsequent shell metacharacters may then be interpreted by the shell instead of being treated as query data. Independently, unescaped quotation marks, backslashes, or control characters can corrupt the JSON body.
This is an instruction-level coding flaw rather than evidence that the skill intentionally executes malicious commands. Exploitability depends on an agent or implementation following the documented template through a shell and directly interpolating untrusted input.
Attack Path
- An attacker submits a finance-related query containing a single quote followed by shell syntax and an attacker-selected command.
- The agent constructs the documented
curlcommand by directly replacing the query placeholder. - The single quote closes the intended
--dataargument. - The shell interprets the remaining injected syntax as command operators or additional commands.
- The injected command executes with ...[truncated 925 chars]
- Remediation
View remediation
Remediation Suggestions
-
Never substitute user-controlled text directly into a shell command template.
-
Construct the request body with a JSON serializer. For example:
bash printf '%s' "$QUERY" | jq -Rs '{query: .}' | curl --fail-with-body --silent --show-error \ --request POST \ --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/news-search' \ --header 'Content-Type: application/json' \ --header "apikey:${MX_APIKEY}" \ --data-binary @- -
Prefer a native HTTP client that accepts arguments without invoking a shell and uses a language-provided JSON encoder.
-
Explicitly instruct the agent not to generate executable command strings by concatenating or interpolating user input.
-
Validate query length and expected character encoding as defense-in-depth, while recognizing that validation is not a replacement for safe serialization.
-
Keep
MX_APIKEYscoped to the minimum required permissions, rotate it if exposure is suspected, and avoid logging request headers or the complete environment. -
Add tests containing single quotes, double quotes, backslashes, newlines, JSON control characters, and shell metacharacters to verify that all input remains inert request data.
-