T09 · Insecure Skill Coding Practices
- Location
SKILL.md:183- Finding
Shell Command Injection Through Untrusted Template Parameters
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 183–203
Vulnerability Type: Shell command injection
Risk Level: HighVulnerable Code
bash aliyunlog log get_log \ --project="{{project}}" \ --logstore="{{logstore}}" \ --from_time="{{from_time}}" \ --to_time="{{to_time}}" \ {{#if topic}}--topic="{{topic}}"{{/if}} \ {{#if query}}--query="{{query}}"{{/if}} \ {{#if reverse}}--reverse={{reverse}}{{/if}} \ {{#if offset}}--offset={{offset}}{{/if}} \ {{#if size}}--size={{size}}{{/if}} \ {{#if power_sql}}--power_sql={{power_sql}}{{/if}} \ {{#if access-id}}--access-id="{{access-id}}"{{/if}} \ {{#if access-key}}--access-key="{{access-key}}"{{/if}} \ {{#if sts-token}}--sts-token="{{sts-token}}"{{/if}} \ {{#if region-endpoint}}--region-endpoint="{{region-endpoint}}"{{/if}} \ {{#if client-name}}--client-name="{{client-name}}"{{/if}} \ {{#if profile}}--profile="{{profile}}"{{/if}} \ {{#if jmes-filter}}--jmes-filter="{{jmes-filter}}"{{/if}} \ {{#if decode-output}}--decode-output="{{decode-output}}"{{/if}} \ --format-output={{format_output|default("json,no_escape")}}Technical Analysis
The skill constructs a shell command by directly interpolating multiple user-controlled values. Placing values inside double quotes is not sufficient shell escaping: command substitutions such as
$(command)and backtick expressions can still be evaluated by a shell. Parameters rendered without quotes, including Boolean, integer, and output-format fields, present additional injection opportunities if their declared types are not strictly enforced before rendering.The special-character guidance in the document only addresses selected query characters and does not provide a safe, general-purpose shell-argument encoding mechanism. The risk arises if an agent renders this template into a command string and executes it through a shell.
Attack Path
- An attacker supplies a malicious value for a ...[truncated 927 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not execute a rendered command string through a shell.
- Invoke
aliyunlogwith a structured argument array and disable shell interpretation, such asshell=False. - Enforce strict type checks for Boolean and integer parameters.
- Validate project, logstore, profile, client name, output format, endpoint, and similar fields against narrowly defined allowlists.
- Pass the query as one literal process argument rather than attempting manual shell escaping.
- Reject control characters, unexpected option prefixes, and invalid endpoint formats where applicable.
- If the skill only displays commands, use a platform-specific quoting library and clearly state that displayed text must not be passed to a shell without validation.
- Require explicit user confirmation before executing commands containing sensitive parameters or unusually complex query input.