T09 · Insecure Skill Coding Practices
- Location
SKILL.md:145- Finding
Unvalidated Execution of Payload-Provided CLI Commands
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 145
Vulnerability Type: Command injection through untrusted command strings
Risk Level: HighVulnerable Code Snippet
markdown 4. If publication is required, prefer the Smithery CLI command contained in `payload["commands"]`; use the web page only for login, verification, and result confirmation.The snippet is an English translation of the instruction at the specified source location.
Technical Analysis
The skill instructs the agent to prefer CLI commands supplied through
payload["commands"]. The document identifiespayloadas part of generatedskill_inputs, but it does not require the command to be validated before execution.No controls are specified for:
- Restricting the executable to an approved Smithery CLI binary.
- Allowlisting supported subcommands and options.
- Separating executable arguments from a shell command string.
- Rejecting shell metacharacters, command substitutions, redirects, or pipelines.
- Verifying that the command performs only the requested publication operation.
- Displaying the exact command and obtaining explicit approval before local execution.
Consequently, a compromised publishing tool or maliciously constructed input could place arbitrary shell operations in
payload["commands"]. An agent following the skill could interpret those operations as an authorized part of the publishing workflow. The existing confirmation requirement applies to final external submission actions, not explicitly to local CLI execution, so it does not reliably mitigate this command-execution path.Attack Path
- An attacker controls, modifies, or influences the generated
skill_inputs. - The attacker inserts a malicious shell command into
payload["commands"], potentially combining a legitimate Smithery command with command separators, substitutions, redirects, or unrelated executables. - A user invokes the skill to publish an MCP server to Smith ...[truncated 1153 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not execute command strings supplied directly through
payload["commands"]. - Construct the Smithery invocation internally from individually validated fields.
- Use a fixed, trusted executable path and an argument-array API that does not invoke a shell.
- Allowlist the exact Smithery subcommands and options required by the publishing workflow.
- Validate identifiers, repository URLs, server URLs, and file paths against strict formats and expected schemes.
- Reject shell control characters and constructs, including separators, pipelines, redirects, substitutions, and newline injection.
- Display the normalized executable and every argument to the user before execution.
- Require explicit confirmation for local CLI execution separately from confirmation for final external submission.
- Run the command with least privilege in a restricted working directory and sanitized environment.
- Avoid forwarding unrelated environment variables or credentials to the child process.
- Record the validated command, approval, exit status, and resulting publication URL for auditability.
- Prefer a typed publisher API over shell-based automation wherever one is available.
- Do not execute command strings supplied directly through