T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:136
- Finding
- Command Injection Through Unquoted Project Path Interpolation## Vulnerability Details **File Location**: `SKILL.md:136-175` and duplicated guidance at `SKILL.md:1258-1280` **Vulnerability Type**: OS command injection **Risk Level**: High ### Vulnerable Code ```text 2. `exec find {project} -maxdepth 2 -name "*.config.*" -o -name "go.mod" -o -name "Cargo.toml" -o -name "pom.xml" -o -name "app.json"` 3. `exec ls {project}/src-tauri/ {project}/electron/ 2>/dev/null` 4. `exec ls {project}/android/ {project}/ios/ 2>/dev/null` 2. `exec ls {project}/` 5. `exec find {project} -name "*.config.*" -maxdepth 1` 1. `exec find {project}/src -type d -maxdepth 2` 3. `exec find {project} -name ".eslintrc*" -o -name ".prettierrc*" -o -name "tsconfig.json" -maxdepth 1` 4. `exec find {project} -name "Dockerfile" -o -name "docker-compose*" -o -name ".github" -type d -maxdepth 2` 5. `exec find {project} -name "*.test.*" -o -name "*.spec.*" | head -5` - `exec find {project}/src -name "router*" -o -name "routes*" | head -5` - `exec find {project}/src -name "store*" -o -name "*reducer*" | head -5` - `exec find {project}/src -name "request*" -o -name "api*" -o -name "http*" | head -5` - `exec find {project} -path "*/migration*" -o -path "*/schema*" | head -5` - `exec find {project} -path "*/middleware*" -o -path "*/guard*" | head -5` - `exec find {project} -path "*/route*" -o -name "controller*" | head -5` - `exec find {project} -name "preload*" -o -name "bridge*" | head -5` `exec find {project} -type f | wc -l` ``` ### Technical Analysis The skill accepts a project path or repository location and instructs the agent to substitute it directly into shell command templates. The `{project}` value is not quoted, canonicalized, constrained to an approved workspace, or passed as a separate process argument. If the execution tool invokes these templates through a shell, a project value containing shell metacharacters such as semicolons, command substitutions, redirections, or pipelines can cha ...[truncated 2071 chars]
- Remediation
- ## Remediation Suggestions 1. **Prefer structured filesystem tools.** Replace shell-based `find` and `ls` templates with APIs that accept the project path as a distinct typed argument and do not invoke a command interpreter. 2. **Avoid command-string construction.** If an external utility is necessary, invoke it through an argument-array API, for example conceptually passing `["find", validatedProjectPath, ...]`, rather than concatenating `{project}` into a shell command. 3. **Canonicalize and constrain the path.** Resolve the supplied path to its canonical absolute form and verify that it is located beneath an explicitly approved workspace root. Reject paths that escape the root through traversal or symbolic links. 4. **Validate input before execution.** Confirm that the path exists, is a directory, is readable, and contains no null bytes or control characters. Do not rely solely on a metacharacter denylist, because shell syntax has many alternate forms. 5. **Quote defensively when a shell is unavoidable.** Apply shell-specific escaping to the complete path and use `--` before path operands where the invoked utility supports it. Quoting should be a secondary defense, not a substitute for argument-array execution. 6. **Run with least privilege.** Execute repository inspection in a sandbox with read-only access to the selected project, no unnecessary credentials, restricted network access, and no access to unrelated host directories. 7. **Update both language sections.** The unsafe templates at `SKILL.md:136-175` and their English duplicates at `SKILL.md:1258-1280` must be corrected together. 8. **Add adversarial tests.** Test paths containing spaces, quotes, leading hyphens, wildcard characters, semicolons, command substitutions, newlines, traversal components, and symbolic links. Verify that each value is handled only as a filesystem path and can never alter command structure.