T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:26- Finding
Shell Command Injection Through an Unvalidated Feature Name
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 26–30
Vulnerability Type: Command injection through user-controlled command arguments
Risk Level: HighVulnerable code:
bash Run the caniuse command with the feature name: ```bash caniuse <feature-name>text ### Technical Analysis The Skill instructs the Agent to place a feature name derived from the user's request directly into a command template. It does not require argument-array execution, validation against known feature identifiers, shell escaping, or rejection of shell metacharacters. If the Agent constructs this command as a shell string, characters such as command separators, command substitutions, redirections, or pipes can cause the shell to interpret part of the feature name as a separate operation. Quoting some example phrases elsewhere in the file does not establish a safe and consistently enforced execution mechanism. The vulnerability is therefore exploitable when an attacker controls the requested feature name and the Agent substitutes it into a shell command. ### Attack Path 1. An attacker submits a browser-compatibility request containing shell syntax as the purported feature name. 2. The Agent follows the documented `caniuse <feature-name>` template and interpolates that value into a shell command. 3. The command is executed through a shell without strict validation or argument-safe invocation. 4. The shell parses the injected syntax as additional commands, substitutions, pipes, or redirections. 5. The injected operation executes with the same operating-system privileges and filesystem access as the Agent process. ### Impact Assessment Successful exploitation can provide arbitrary command execution under the Agent's account. Depending on that account's permissions, an attacker could read or modify accessible files, disclose environment variables and credentials, alter project artifacts, invoke netw ...[truncated 322 chars]- Remediation
View remediation
Remediation Suggestions
- Execute
caniusedirectly through a process API that accepts a program and argument array, rather than constructing a shell command. For example, pass the feature name as one literal argument. - Disable shell interpretation explicitly when supported by the execution tool.
- Validate feature identifiers against a strict allowlist or a conservative pattern appropriate for known Can I Use identifiers.
- Prefer the documented mapping table and reject unexpected control characters, whitespace, shell operators, substitutions, redirections, and newline characters.
- Use an end-of-options delimiter such as
--if the selected CLI supports it, preventing feature names beginning with-from being interpreted as options. - Do not rely solely on ad hoc quoting because quoting errors and platform-specific shell behavior can reintroduce injection.
- Document a safe failure path for unknown feature names instead of trying arbitrary shell-formatted variations.
- Execute