T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:77- Finding
Shell Command Injection Through User-Controlled Dispatch Parameters
- Content
View full analysis
" \ -n "功能名" \ --workdir /项目路径 \ --permission-mode bypassPermissions \ > /tmp/dispatch.log 2>&1 & ``` ### Technical Analysis The documented command places requirement content, a feature name, and a project path into a shell command. These values are derived from user-supplied requirements or dispatch-time input. Double quotes do not neutralize every shell construct. In particular, command substitutions such as `$(command)` and backtick substitutions remain active inside double-quoted strings if untrusted content is directly incorporated into a command that is subsequently parsed by a shell. A value containing a closing quote can also introduce additional shell syntax when command strings are assembled through textual substitution. The `--workdir` placeholder is not quoted at all, increasing exposure to whitespace splitting, glob expansion, and shell metacharacters. The documentation does not require argument-array execution, strict validation, or a non-shell data channel for the specification. ### Attack Path 1. An attacker supplies requirement text containing shell syntax, such as command substitution or a quote-breaking payload. 2. The workflow converts the attacker's requirements into the SPEC. 3. The SPEC or feature name is substituted into the documented shell command. 4. A shell parses the constructed command. 5. The injected expression executes before or alongside `dispatch.sh`. 6. The resulting process runs with the permissions of the user or agent executing the workflow. ### Impact Assessment Successful exploitation can execute arbitrary local commands with the privileges of the workflow process. Depending on those privileges, an attacker may read or modify access ...[truncated 308 chars]- Remediation
View remediation