T09 · Insecure Skill Coding Practices
Error
- Location
scripts/loop.sh:66- Finding
Arbitrary Command Execution Through Shell Evaluation
- Content
View full analysis
/dev/null || echo "") ``` ### Technical Analysis The script passes the contents of the `CLAUDE_TASK` environment variable directly to Bash's `eval` builtin. `eval` parses its input as shell source code, so shell operators, command substitutions, redirections, pipelines, and additional commands embedded in the variable are executed with the privileges of the process running the skill. No allowlist, executable validation, argument separation, or sandbox boundary is applied. Although `CLAUDE_TASK` is intended to represent an agent modification task, the script does not establish that its value originates from a trusted component. ### Attack Path 1. An attacker, compromised child agent, or unsafe integration influences `CLAUDE_TASK`. 2. The variable is populated with shell syntax, such as a legitimate-looking task followed by an additional command. 3. The user starts the autonomous loop. 4. `eval "$CLAUDE_TASK"` reparses the entire value as shell code. 5. The injected commands execute under the account running the skill. ### Impact Assessment Successful exploitation provides arbitrary command execution with the current user's privileges. The attacker could read or modify accessible files, inspect environment variables, alter source repositories, access credentials available to the process, initiate network connections, or execute additional local programs. The scope is not restricted to the target repository. ]]>- Remediation
View remediation