T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:49
- Finding
- Shell Command Injection Through User-Controlled Command Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 49-58 **Vulnerability Type**: Shell command injection through unsafe command construction **Risk Level**: High ### Vulnerable Code ```bash yummycli gemini speak --text "<text>" ``` ```bash yummycli gemini speak \ --text "<text>" \ --voice Kore \ --output narration.wav ``` ### Technical Analysis The documented command templates place user-controlled narration text directly inside shell commands. Although the placeholder is enclosed in double quotes, double-quoted Bash strings still process command substitutions such as `$(command)` and backtick expressions when those expressions become part of the command text parsed by the shell. The output path may also be user-controlled. If an agent constructs a shell command as a string by replacing these placeholders, malicious quotation marks, command substitutions, redirections, or shell metacharacters could alter the intended command. This issue applies when the agent generates or executes a shell command from the documented template. It can be avoided by invoking the executable directly with a structured argument array and without a shell. ### Attack Path 1. An attacker requests speech synthesis using malicious text, such as text containing `$(malicious-command)` or a quotation mark followed by shell syntax. 2. The agent substitutes the supplied text into the documented Bash template. 3. The resulting command string is passed to a shell for execution. 4. The shell interprets the injected command substitution or metacharacters before or alongside execution of `yummycli`. 5. The injected command runs with the operating-system privileges and environment available to the agent. ### Impact Assessment Successful exploitation could allow arbitrary local command execution with the agent's privileges. Depending on the execution environment, this could permit: - Reading or modifying files accessible to the agent. - Accessing environment vari ...[truncated 389 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Explicitly prohibit constructing shell command strings by interpolating user-provided text, speaker names, voice values, or output paths. - Invoke `yummycli` directly with a structured argument array and shell execution disabled. Conceptually: ```javascript execFile("yummycli", [ "gemini", "speak", "--text", userText, "--voice", selectedVoice, "--output", outputPath ]); ``` - If only a shell execution interface is available, pass untrusted values through positional parameters rather than inserting them into command source text. - Validate voices and models against explicit allowlists. - Validate speaker names according to a restrictive documented format. - Resolve the output path and require it to remain inside an approved workspace directory. - Continue enforcing the `.wav` suffix, but do not treat suffix validation alone as sufficient path validation. - Reject output paths containing traversal components or paths that resolve through symbolic links outside the approved directory. - Add tests using quotation marks, `$()`, backticks, semicolons, redirections, newlines, and path traversal sequences to verify that each value is passed as one literal process argument. ]]>