T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:23- Finding
Shell Injection Through Unsafely Interpolated Tool Arguments
- Content
View full analysis
source ../../polymarket_venv/bin/activate && export MARKET_SLUG='{{market_slug}}' && export DIRECTION='{{direction}}' && export PRICE={{price}} && export SIZE={{size}} && python trade.py ``` ### Technical Analysis Tool arguments are interpolated directly into a command interpreted by a shell. Assigning values to environment variables does not prevent command injection when those assignments are themselves assembled as shell source code. `market_slug` and `direction` are enclosed in single quotes, but an input containing a single quote can terminate the quoted value and introduce shell operators or additional commands. `price` and `size` are interpolated without any shell quoting. Although those fields are declared as numbers, the command remains dependent on the surrounding tool framework enforcing that type before interpolation. This behavior directly contradicts the comment claiming that environment-variable use prevents shell injection. No strict allowlist, shell escaping mechanism, or argument-array execution boundary is present in the supplied configuration. ### Attack Path 1. An attacker or untrusted caller supplies a crafted `market_slug` or `direction` containing a quote followed by shell syntax. 2. The template engine substitutes that input directly into the `command` string. 3. The injected quote terminates the intended environment-variable value. 4. The shell interprets the remaining text as operators and commands. 5. The injected command runs with the same operating-system identity, filesystem access, environment, an ...[truncated 928 chars]- Remediation
View remediation
DIRECTION: PRICE: SIZE: ``` 5. Enforce an allowlist for `direction`, strict numeric schemas for `price` and `size`, and a conservative character/length policy for market slugs before process invocation. 6. Do not rely solely on shell escaping. If a shell is unavoidable, use a trusted escaping API and reject values outside the expected grammar. 7. Run the Skill under a restricted account with minimal filesystem and network permissions. 8. Use a dedicated, minimally funded wallet so compromise of the process environment has limited financial impact. ]]>