T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:126
- Finding
- Model-Derived Keywords Are Unsafely Interpolated into a Shell Command## Vulnerability Details **File Location**: `SKILL.md`, lines 126–136 **Vulnerability Type**: Command injection through unsafe shell-command construction **Risk Level**: Medium ### Vulnerable Code Snippet ```bash grep -l "word1\|word2\|word3" *.md ``` The surrounding instructions require the model to derive keywords from note content and substitute those keywords into this command. ### Technical Analysis The search terms originate indirectly from untrusted note content. The skill provides a shell-command template but does not require escaping, validation, fixed-string matching, safe argument passing, or an option terminator. If an agent constructs and executes the command literally, a generated keyword containing quotation marks, command substitutions, shell metacharacters, or control operators could escape the quoted search expression and change the command's behavior. Regular-expression metacharacters can also alter matching semantics even when they do not achieve command execution. The unguarded `*.md` expansion presents an additional argument-handling weakness. A matching filename beginning with a hyphen may be interpreted by `grep` as an option because the command does not use `--`. Exploitation is conditional on the executing agent converting model output into shell source without applying its own escaping. Nevertheless, the skill explicitly recommends this construction and supplies no required safeguards. ### Attack Path 1. An attacker places crafted text in a note located under the configured notes directory. 2. The daily-note workflow reads the attacker-controlled note. 3. The model extracts a crafted value as one of the search keywords. 4. The agent inserts that value into the documented `grep` command without shell-safe encoding. 5. The shell interprets injected syntax rather than treating the entire value as inert search data. 6. Commands may execute with the permissions of the agent process, or the search may be manipulated to include u ...[truncated 677 chars]
- Remediation
- ## Remediation Suggestions - Prefer a structured file-search API that accepts search terms and paths as separate values without invoking a shell. - If `grep` must be used, pass each keyword as a separate argument and use fixed-string matching: ```bash grep -F -l -- \ -e "$keyword1" \ -e "$keyword2" \ -e "$keyword3" \ ./*.md ``` - Do not generate a shell command by concatenating model output. - Validate extracted keywords against a restrictive allowlist and reject quotation marks, control characters, shell metacharacters, and leading hyphens. - Use an API such as Python's `subprocess.run` with `shell=False` and a list of arguments. - Add `--` before file operands to prevent filenames from being interpreted as options. - Resolve and validate all candidate file paths against the configured notes root before reading them. - Document that note content is untrusted data and must never be interpreted as executable instructions.