T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:107- Finding
Stored Terminal Control-Sequence Injection
- Content
View full analysis
> "$DATA_DIR/history.log"; } ``` ```bash _search() { local term="${1:?Usage: clipbox search }" echo "Searching for: $term" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local m=$(grep -i "$term" "$f" 2>/dev/null || true) if [ -n "$m" ]; then echo " --- $(basename "$f" .log) ---" echo "$m" | sed 's/^/ /' fi done } _recent() { echo "=== Recent Activity ===" tail -20 "$DATA_DIR/history.log" 2>/dev/null | sed 's/^/ /' || echo " No activity yet." } ``` ```bash case "${1:-help}" in check) shift if [ $# -eq 0 ]; then echo "Recent check entries:" tail -20 "$DATA_DIR/check.log" 2>/dev/null || echo " No entries yet. Use: clipbox check " else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/check.log" local total=$(wc -l < "$DATA_DIR/check.log") echo " [Clipbox] check: $input" echo " Saved. Total check entries: $total" _log "check" "$input" fi ;; ``` The other record commands repeat the same unsafe storage and display pattern. ### Technical Analysis ClipBox accepts arbitrary text, stores it verbatim in category logs and `history.log`, and later prints that content directly to a terminal. It does not remove or visibly encode control characters such as ANSI CSI and OSC sequences. Shell quoting prevents the text from being evaluated as shell syntax, but it does not prevent a terminal emulator from interpreting embedded escape sequences after `echo`, `tail`, `grep`, or `sed` writes ...[truncated 1388 chars]- Remediation
View remediation