T09 · Insecure Skill Coding Practices
Error
- Location
- workflows/text-to-design.md:19
- Finding
- User-Controlled Prompt Interpolation into Shell Command Templates## Vulnerability Details **File Location**: `workflows/text-to-design.md:19-21`, `workflows/edit-design.md:23-31`, and `workflows/variants.md:19-21` **Vulnerability Type**: Shell command injection through unsafe handling of user-derived arguments **Risk Level**: High **Affected code snippets**: `workflows/text-to-design.md:19-21` ```bash cd "${STITCH_STARTER_ROOT:-$HOME/.agents/stitch-starter}" npm run generate -- --prompt "..." [--project-id ...] [--device DESKTOP] ``` `workflows/edit-design.md:23-31` ```bash cd "${STITCH_STARTER_ROOT:-$HOME/.agents/stitch-starter}" npm run edit -- --prompt "..." ``` Or target a specific screen: ```bash cd "${STITCH_STARTER_ROOT:-$HOME/.agents/stitch-starter}" npm run edit -- --project-id ... --screen-id ... --prompt "..." ``` `workflows/variants.md:19-21` ```bash cd "${STITCH_STARTER_ROOT:-$HOME/.agents/stitch-starter}" npm run variants -- --prompt "..." --variant-count 3 ``` ### Technical Analysis These workflows direct the agent to derive a prompt from user-controlled content and substitute it into shell command templates. They do not require a non-shell process API, strict argument validation, a safe prompt-input file, or robust shell escaping. Enclosing a substituted value in double quotes is not sufficient protection when a command is interpreted by a shell. Shell constructs such as command substitution, backticks, embedded quote termination, and certain expansions can still be evaluated if the agent constructs the final command as text. The project and screen identifiers shown in the edit and generation templates are likewise not subject to documented validation. This is an instruction-level unsafe coding pattern rather than evidence that the repository itself contains an active malicious payload. Exploitability depends on the invoking agent replacing the placeholders with untrusted values and executing the assembled command through a shell. ### Atta ...[truncated 1619 chars]
- Remediation
- ## Remediation Suggestions 1. Invoke the CLI through a process execution API that accepts an executable and an argument array, with shell processing explicitly disabled. For example, pass `npm`, `run`, `generate`, `--`, `--prompt`, and the prompt as separate arguments rather than constructing one command string. 2. Do not use `exec`, `sh -c`, `bash -c`, or equivalent shell-evaluated command strings for user-derived prompts. 3. If the agent environment only supports shell execution, write the prompt to a securely created temporary file and update the toolkit to accept a `--prompt-file` option. Use restrictive file permissions and delete the file after use. 4. Validate `project-id` and `screen-id` values with strict allowlists appropriate to the Stitch API. Reject whitespace, shell metacharacters, option prefixes, path separators, and values outside the expected format. 5. Use an explicit allowlist for `--device`, `--creative-range`, and `--aspects`. 6. Add workflow instructions stating that user content must never be directly interpolated into shell command text. 7. Run the toolkit under a least-privileged account and restrict read access to `.env` so unrelated processes and users cannot access the API key. 8. Add security tests containing quotes, backticks, `$()`, semicolons, newlines, and option-injection payloads to confirm that all supplied text is delivered as a single literal argument.