T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:153- Finding
Shell Command Injection Through Unescaped Runtime Values
- Content
View full analysis
\ || ${ACPX_CMD} codex sessions new --name oc-codex- ${ACPX_CMD} codex -s oc-codex- --cwd --format quiet "" ``` One-shot: ```bash ${ACPX_CMD} codex exec --cwd --format quiet "" ``` ### Technical Analysis The command templates interpolate `conversationId`, `workspacePath`, and `prompt` directly into command strings intended for an `exec` shell interface. The workspace path and session identifier are not quoted or validated. Although the prompt is surrounded by double quotes, an attacker can potentially terminate the quoted argument with another double quote and introduce shell metacharacters, command substitutions, or additional commands. Quoting alone is not a reliable defense when untrusted values are concatenated into a shell command. The vulnerability becomes exploitable if any of these values can contain attacker-controlled characters and the resulting string is interpreted by a shell rather than passed directly to the executable as an argument array. ### Attack Path 1. An attacker supplies a crafted prompt, workspace path, or conversation identifier. 2. The value includes shell syntax such as a closing quote, command separator, command substitution, or redirection operator. 3. The Agent substitutes the value into one of the documented command templates. 4. The Agent invokes the resulting string through the `exec` shell interface. 5. The shell parses the injected syntax and executes the attacker's additional command with the Agent process's operating-system privileges. ### Impact Assessment Successful exploitation could permit arbitrary command execution under the account running the Agent. The attacker could potentially: - Read or ...[truncated 424 chars]- Remediation
View remediation