T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:56- Finding
Shell Command Injection Through Interpolated URLs and JSON Data
- Content
View full analysis
→ Is data present and still valid? Read structured JSON → convert to human-readable output → return directly Step 2 — Scrape Liquipedia with Playwright Scraper exec: node /userspace/skills/playwright-scraper-skill-1-2-0/scripts/playwright-stealth.js "" → Wait for page loading, then extract data from the output Step 3 — Save data in the schema.md format exec: python3 references/cache_manager.py save '' ``` The same unsafe URL invocation pattern is repeated in the command examples at lines 582-583, 616, 669, and 711. ### Technical Analysis The Skill instructs the agent to insert URLs, identifiers, and scraped JSON directly into shell command strings. Wrapping a URL in double quotes does not prevent shell command substitution. Shell constructs such as `$(command)` and backticks are still evaluated inside double-quoted strings. Similarly, wrapping JSON in single quotes is unsafe when the JSON contains an apostrophe: the apostrophe terminates the quoted argument and allows subsequent text to be interpreted as shell syntax. The affected values can originate from user-supplied player or team names and from remotely scraped page content. The instructions do not require URL validation, shell escaping, argument-array execution, or use of standard input for JSON. ### Attack Path 1. An attacker submits a team, player, or URL-like query containing shell metacharacters, such as a command substitution expression. 2. The agent constructs a Liquipedia or OWTV URL using the supplied value. 3. Following the Skill instructions, the agent inserts the constructed URL into: ```bash node scripts/playwright-stealth.js "" ``` 4. A shell ...[truncated 952 chars]- Remediation
View remediation