T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:100- Finding
Command Injection and Path Traversal Through Unvalidated Skill Names
- Content
View full analysis
cat > $SKILL_DIR//SKILL.md << 'SKILL_EOF' SKILL_EOF ``` ### Technical Analysis The workflow instructs the agent to substitute a user-influenced skill name directly into shell commands. Although the documentation says skill names should use kebab-case, it does not require validation before command construction. The destination path is also unquoted. A crafted value containing shell metacharacters, command substitutions, whitespace, path separators, or traversal sequences could change the meaning of the generated command. For example, shell control operators could append another command, while `../` sequences could direct the file write outside the intended skill directory. Because these commands are intended to be executed by the agent, exploitation occurs with the operating-system permissions assigned to the agent process. ### Attack Path 1. An attacker asks the agent to create a workflow and supplies a malicious skill name. 2. The skill accepts or derives that name without applying a mandatory allowlist. 3. The agent replaces `` in the documented shell sequence. 4. The shell interprets attacker-controlled metacharacters or traversal components. 5. The injected command executes, or `SKILL.md` is written outside the intended skill directory. The attack depends on the agent following the documented shell-based creation procedure without independently sanitizing the value. ### Impact Assessment Successful exploitation could: - Execute arbitrary shell commands with the agent's privileges. - Create or overwrite files writable by the agent. - Write persistent skill instructions outside the intended destination. - Corrupt other skills or agent configuration files. - Expose or modify ...[truncated 238 chars]- Remediation
View remediation