T09 · Insecure Skill Coding Practices
Error
- Location
index.js:16- Finding
Shell Command Injection Through Unvalidated NLU Output
- Content
View full analysis
production - "先部署到测试服务器" -> staging - "开发环境更新" -> dev ` }); if (parsed && parsed.environment) { env = parsed.environment; } } catch (err) { context.log("NLU 解析失败，使用默认 dev 环境:", err); } context.log(`解析到部署环境: ${env}`); ``` ```js output = await runCommand(`ssh supplywhy-dev-master "sed -i 's|590183820143.dkr.ecr.us-west-2.amazonaws.com/genie:.*|590183820143.dkr.ecr.us-west-2.amazonaws.com/genie:${env}|' genie/deployment.yaml"`); ``` The interpolated command is ultimately executed through `child_process.exec`: ```js const { exec } = require("child_process"); // 执行 shell 命令工具 async function runCommand(command) { return new Promise((resolve, reject) => { exec(command, (err, stdout, stderr) => { if (err) return reject(stderr || err); resolve(stdout); }); }); } ``` ### Technical Analysis The Slack-controlled value `params.slack_text` is submitted to `context.nlpParse`. The returned `parsed.environment` value is assigned directly to `env` without checking its type or enforcing the documented allowlist of `production`, `staging`, and `dev`. Instructions given to an LLM do not constitute a security boundary. Crafted natural-language input may cause the parser to return an unexpected string containing shell syntax. That string is interpolated into a nested local and remote she ...[truncated 2497 chars]- Remediation
View remediation