T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:255- Finding
Shell Command Injection in the Payment Retry Workflow
- Content
View full analysis
| grep -i "^Payment-Needed:" | sed "s/^[Pp]ayment-[Nn]eeded: //" | tr -d "\r\n" > <402_needed_file.txt> && alipay-bot 402-buyer-pay -f <402_needed_file.txt> ``` ### Technical Analysis The retry command places `` and `<402_needed_file.txt>` directly into a shell pipeline without quoting or using a structured subprocess interface. If either value can contain shell metacharacters, the shell will interpret those characters as command syntax rather than as literal argument data. The surrounding instructions claim that resource URLs and filenames must be validated, but this retry branch does not define or demonstrate an enforceable validation operation before interpolation. In particular, checking only that a resource URL starts with `https://` would not be sufficient because a string can satisfy that prefix requirement while also containing shell operators such as `;`, `&`, `|`, command substitutions, redirections, or whitespace-delimited arguments. The filename substitution is also used as a redirection target. If validation is omitted, implemented incorrectly, or bypassed, this may permit unintended file creation or overwrite in addition to command execution. ### Attack Path 1. An attacker controls or influences a service that returns an HTTP `402 Payment Required` response. 2. The associated resource URL contains shell syntax while retaining an apparently valid HTTPS prefix. 3. The initial payment operation returns the signature-validation error that activates the documented retry branch. 4. The agent substitutes the malicious resource URL into the unquoted `curl` command. 5. The command is passed to a shell execution tool. 6. The shell interprets the injected metacharacters and executes attac ...[truncated 936 chars]- Remediation
View remediation