T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:100
- Finding
- Command Injection and Path Traversal Through Unvalidated Skill Names<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:100-103` **Vulnerability Type**: OS command injection and arbitrary file-path manipulation **Risk Level**: High ### Vulnerable Code ```bash mkdir -p $SKILL_DIR/<skill-name> cat > $SKILL_DIR/<skill-name>/SKILL.md << 'SKILL_EOF' <Skill content> SKILL_EOF ``` ### Technical Analysis The workflow instructs the agent to substitute a user-influenced skill name directly into shell commands. Although the documentation says skill names should use kebab-case, it does not require validation before command construction. The destination path is also unquoted. A crafted value containing shell metacharacters, command substitutions, whitespace, path separators, or traversal sequences could change the meaning of the generated command. For example, shell control operators could append another command, while `../` sequences could direct the file write outside the intended skill directory. Because these commands are intended to be executed by the agent, exploitation occurs with the operating-system permissions assigned to the agent process. ### Attack Path 1. An attacker asks the agent to create a workflow and supplies a malicious skill name. 2. The skill accepts or derives that name without applying a mandatory allowlist. 3. The agent replaces `<skill-name>` in the documented shell sequence. 4. The shell interprets attacker-controlled metacharacters or traversal components. 5. The injected command executes, or `SKILL.md` is written outside the intended skill directory. The attack depends on the agent following the documented shell-based creation procedure without independently sanitizing the value. ### Impact Assessment Successful exploitation could: - Execute arbitrary shell commands with the agent's privileges. - Create or overwrite files writable by the agent. - Write persistent skill instructions outside the intended destination. - Corrupt other skills or agent configuration files. - Expose or modify ...[truncated 238 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Enforce the documented kebab-case requirement before any filesystem or shell operation: ```python import re if not re.fullmatch(r"[a-z0-9]+(?:-[a-z0-9]+)*", skill_name): raise ValueError("Invalid skill name") ``` 2. Explicitly reject path separators, `..`, control characters, whitespace, shell metacharacters, and command-substitution syntax. 3. Build the destination with a filesystem API, resolve it to a canonical path, and verify that it remains beneath the approved skill root: ```python from pathlib import Path root = Path(skill_dir).resolve() destination = (root / skill_name / "SKILL.md").resolve() if root not in destination.parents: raise ValueError("Destination escapes the skill directory") destination.parent.mkdir(parents=True, exist_ok=True) destination.write_text(skill_content, encoding="utf-8") ``` 4. Prefer direct filesystem APIs over shell-generated `mkdir` and heredoc commands. 5. If shell execution is unavoidable, pass values as separate process arguments without `shell=True`; do not concatenate user-derived values into command strings. 6. Refuse to overwrite an existing skill unless the user explicitly confirms the canonical destination. ]]>