T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:48
- Finding
- Command Injection and Path Traversal Through Unsanitized Workspace Names## Vulnerability Details **File Location**: `SKILL.md`, lines 48–49 and 169–170 **Vulnerability Type**: Unsanitized user-controlled input in shell commands **Risk Level**: High The skill asks the user to confirm or provide a folder or project name and subsequently interpolates that value into shell command templates. ```text mkdir -p /workspace/{文件夹名} mv /inbound/xxx.docx /workspace/{文件夹名}/ ``` A second affected command block constructs directories and files from the project and subdirectory names: ```text mkdir -p /workspace/{项目名}/{子目录} touch /workspace/{项目名}/docs/01-概述.md # 创建空文件 ``` ### Technical Analysis The placeholders for the folder name, project name, and subdirectory are used in shell commands without mandatory input validation, shell-safe argument handling, quoting, or canonical-path verification. At least the folder name can be directly selected or corrected by the user. If these templates are executed through a shell after direct substitution, shell metacharacters in a supplied name can be interpreted as command syntax rather than filename data. Separately, traversal sequences such as `../` or absolute paths can cause filesystem operations to escape the intended `/workspace` directory. User confirmation does not provide a security boundary because the user controls the value being confirmed. The instructions also do not require the agent to reject unsafe characters or verify the resolved destination. ### Attack Path 1. The attacker invokes the skill with an otherwise valid request to generate a design document. 2. When asked to confirm the proposed folder name, the attacker supplies a name containing shell syntax or path traversal components. 3. The agent inserts the supplied value into the documented `mkdir`, `mv`, or `touch` command. 4. If a shell executes the interpolated command, shell syntax can invoke an unintended command. If traversal is used, the resolved path can point outside `/workspa ...[truncated 866 chars]
- Remediation
- ## Remediation Suggestions 1. Treat every user-selected folder, project, and subdirectory name as untrusted input. 2. Apply a strict allowlist for names, permitting only necessary letters, digits, spaces, underscores, and hyphens. Reject shell metacharacters, control characters, path separators, `.` and `..` path components, and absolute paths. 3. Resolve the destination to a canonical path and verify that it remains strictly below the designated workspace root before performing any operation. 4. Prefer structured filesystem APIs or dedicated file-operation tools that accept paths as discrete arguments rather than constructing shell command strings. 5. If shell commands cannot be avoided, pass values as separately quoted arguments, use `--` before path arguments, and never build a command by direct string substitution. 6. Generate an internal safe directory identifier when the requested display name is unsafe, while retaining the original name only as metadata. 7. Copy inbound documents instead of moving them unless destructive relocation is explicitly required and confirmed. 8. Add negative tests covering command separators, command substitution, leading option characters, absolute paths, traversal sequences, embedded newlines, and Unicode separator variants.