T09 · Insecure Skill Coding Practices
Error
- Location
scripts/claude-code-bridge.sh:136- Finding
Shell Command Injection Through the Working Directory Argument
- Content
View full analysis
"$SANDBOX_FLAG" else # Expand ~ to $HOME workdir="${workdir/#\~/$HOME}" fi # Verify that the directory exists if [[ ! -d "$workdir" ]]; then echo "[claude-code-bridge] ❌ Directory does not exist: $workdir" rm -f "$SANDBOX_FLAG" return 1 fi # Record the working directory echo "$workdir" > "$WORKDIR_FILE" # Build startup command local launch_cmd launch_cmd="cd '$workdir' && unset CLAUDECODE CLAUDE_CODE; export TERM=xterm-256color; exec '$CLAUDE_BIN'" # Start Claude inside tmux tmux new-session -d -s "$TMUX_NAME" -x 220 -y 50 "bash --login -c '$launch_cmd'" ``` ### Technical Analysis The working directory is derived from the third command-line argument, which the Skill instructions populate from a path supplied through a chat message. Although the script verifies that the path identifies an existing directory, it later interpolates that value into a shell command using manually constructed single quotes. A single quote inside the directory name can terminate the intended quoting context. Subsequent shell metacharacters in that directory name can then become executable shell syntax when the generated string is evaluated by `bash --login -c`. There are two nested levels of shell command interpretation: 1. `launch_cmd` embeds `workdir` and `CLAUDE_BIN` in a command string. 2. That command string is embedded again in the argument passed to `bash --login -c`. The directory existence check does not prevent exploitation because Unix file names may legally contain qu ...[truncated 2019 chars]- Remediation
View remediation