T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:299- Finding
Command and JSON Injection Through Unvalidated Workflow Placeholders
- Content
View full analysis
" if [ ! -d "" ]; then gh repo clone / "" else cd "" && git pull --rebase origin fi ``` ```bash gh repo create / \ --public \ --description "Static blog for Medium cross-posting" \ --clone \ --add-readme ``` ```bash printf '%s\n' '{' \ ' "schema_version": 1,' \ " \"github_owner\": \"\"," \ " \"github_repo\": \"\"," \ " \"pages_url\": \"\"," \ " \"default_author\": \"\"," \ " \"branch\": \"\"" \ '}' > "/.medium-skill-config.json" ``` ```bash git commit -m "feat(posts): add \"\" []" git push origin ``` ```bash git commit -m "chore(posts): link medium draft for \"\"" git push origin ``` ### Technical Analysis The workflow directs the Agent to substitute user-controlled or configuration-derived values directly into shell source. These values include the post title, GitHub owner, repository name, branch, local path, and values read from persistent configuration files. The post title is embedded inside a double-quoted shell argument. Double quotes prevent ordinary word splitting but do not prevent command substitution. For example, a title containing `$(malicious-command)` would still be evaluated by a POSIX shell when the generated command runs. Repository and branch placeholders are used without shell quoting in multiple commands. Shell metacharacters can therefore alter command structure, while values beginning with a hyphen can potential ...[truncated 2596 chars]- Remediation
View remediation