T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:55- Finding
Unescaped Record Data Enables Export and Terminal Injection
- Content
View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ;; ``` Search and recent-activity functions also print stored content directly to the terminal: ```bash _search() { local term="${1:?Usage: plant search }" echo "Searching for: $term" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local m=$(grep -i "$term" "$f" 2>/dev/null || true) if [ -n "$m" ]; then echo " --- $(basename "$f" .log) ---" echo "$m" | sed 's/^/ /' fi done } _recent() { echo "=== Recent Activity ===" tail -20 "$DATA_DIR/history.log" 2>/dev/null | sed 's/^/ /' || echo " No activity yet." } ``` Representative record ingestion stores input without validation ...[truncated 3715 chars]- Remediation
View remediation