T09 · Insecure Skill Coding Practices
Error
- Location
scripts/search.sh:199- Finding
Shell Command Injection Through Background Task Name
- Content
View full analysis
"$OUTPUT_DIR/${TASK_NAME}.log" 2>&1 & ``` ### Technical Analysis The `--task-name` argument is accepted as unrestricted user-controlled text and appended to a timestamp. In background mode, this value is interpolated directly into dynamically generated Bash source code: ```bash TASK_NAME='$TASK_NAME' ``` Although the generated command is enclosed in double quotes at the outer level, the task name is placed inside a single-quoted assignment within the generated `bash -c` program. An embedded single quote can terminate that assignment and introduce arbitrary shell syntax. For example, a task name resembling the following can alter the generated command: ```text x'; touch /tmp/pwned; # ``` The later timestamp does not neutralize the payload. The semicolon introduces another command, while the comment marker can suppress the remainder of the generated shell line. The new Bash process then parses and executes the injected command. This issue is specifically reachable when `--background` is used because the foreground path invokes `run_research` directly without reconstructing its variables as shell source. ### Attack Path 1. An attacker influences the arguments used to invoke `search.sh`, includi ...[truncated 1260 chars]- Remediation
View remediation