T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:179- Finding
Shell Command Injection Through Unsanitized User-Controlled Query Parameters
- Content
View full analysis
" --start-date --end-date --output json # Block-level metrics (MUST specify device type) ptengine-cli heatmap query --query-type block_metrics \ --url "" --start-date --end-date \ --device-type --output json # Dimension-grouped insights (for ad/audience analysis) ptengine-cli heatmap query --query-type page_insight \ --url "" --fun-name \ --start-date --end-date --output json # Filtered data (for compare) ptengine-cli heatmap query --query-type block_metrics \ --url "" --start-date --end-date \ --device-type MOBILE --filter "visitType include newVisitor" --output json ``` ### Technical Analysis The workflow instructs the agent to collect a URL and other parameters from the user and interpolate them into shell command templates. It does not require validation, shell escaping, or execution through an argument-vector API. Placing the URL inside double quotes does not fully prevent shell injection. Shell constructs such as command substitution remain active inside double-quoted strings. For example, if a generated command includes a URL containing `$(malicious-command)`, a shell can execute that command before invoking `ptengine-cli`. The unquoted date, device, and function-name placeholders create additional injection opportunities if the implementation accepts values outside the documented enumeration. Similar risk applies to dynamically generated filter values in comparison workflows. This behavior exceeds the minimum privileges needed to query analytics. The task only requires passing inert strings to `ptengine-cli`; it does not re ...[truncated 1745 chars]- Remediation
View remediation