T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cc-bridge.sh:27- Finding
Environment-Controlled Command Injection Through CLAUDE_BIN
- Content
View full analysis
" start ``` 4. `do_start` interpolates the malicious value into `launch_cmd`. 5. The nested `bash --login -c` evaluates the injected syntax. 6. The attacker's comm ...[truncated 614 chars]- Remediation
View remediation
&2 return 1 } [[ -f "$CLAUDE_BIN" && -x "$CLAUDE_BIN" ]] || { echo "[cc-bridge] CLAUDE_BIN is not an executable file" >&2 return 1 } tmux new-session -d -s "$TMUX_NAME" -x 220 -y 50 \ env -u CLAUDECODE -u CLAUDE_CODE TERM=xterm-256color \ "$CLAUDE_BIN" ``` - If a login shell is strictly required, supply the executable through a positional parameter rather than interpolating it: ```bash tmux new-session -d -s "$TMUX_NAME" -x 220 -y 50 \ bash --login -c 'unset CLAUDECODE CLAUDE_CODE; export TERM=xterm-256color; exec "$1"' \ cc-bridge "$CLAUDE_BIN" ``` - Consider removing the environment override entirely when runtime configurability is unnecessary. - Run the bridge under a dedicated, least-privileged operating-system account. ]]>