T09 · Insecure Skill Coding Practices
- Location
SKILL.md:48- Finding
Command Injection and Path Traversal Through Unsanitized Workspace Names
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 48–49 and 169–170
Vulnerability Type: Unsanitized user-controlled input in shell commands
Risk Level: HighThe skill asks the user to confirm or provide a folder or project name and subsequently interpolates that value into shell command templates.
text mkdir -p /workspace/{文件夹名} mv /inbound/xxx.docx /workspace/{文件夹名}/A second affected command block constructs directories and files from the project and subdirectory names:
text mkdir -p /workspace/{项目名}/{子目录} touch /workspace/{项目名}/docs/01-概述.md # 创建空文件Technical Analysis
The placeholders for the folder name, project name, and subdirectory are used in shell commands without mandatory input validation, shell-safe argument handling, quoting, or canonical-path verification. At least the folder name can be directly selected or corrected by the user.
If these templates are executed through a shell after direct substitution, shell metacharacters in a supplied name can be interpreted as command syntax rather than filename data. Separately, traversal sequences such as
../or absolute paths can cause filesystem operations to escape the intended/workspacedirectory.User confirmation does not provide a security boundary because the user controls the value being confirmed. The instructions also do not require the agent to reject unsafe characters or verify the resolved destination.
Attack Path
- The attacker invokes the skill with an otherwise valid request to generate a design document.
- When asked to confirm the proposed folder name, the attacker supplies a name containing shell syntax or path traversal components.
- The agent inserts the supplied value into the documented
mkdir,mv, ortouchcommand. - If a shell executes the interpolated command, shell syntax can invoke an unintended command. If traversal is used, the resolved path can point outside `/workspa ...[truncated 866 chars]
- Remediation
View remediation
Remediation Suggestions
- Treat every user-selected folder, project, and subdirectory name as untrusted input.
- Apply a strict allowlist for names, permitting only necessary letters, digits, spaces, underscores, and hyphens. Reject shell metacharacters, control characters, path separators,
.and..path components, and absolute paths. - Resolve the destination to a canonical path and verify that it remains strictly below the designated workspace root before performing any operation.
- Prefer structured filesystem APIs or dedicated file-operation tools that accept paths as discrete arguments rather than constructing shell command strings.
- If shell commands cannot be avoided, pass values as separately quoted arguments, use
--before path arguments, and never build a command by direct string substitution. - Generate an internal safe directory identifier when the requested display name is unsafe, while retaining the original name only as metadata.
- Copy inbound documents instead of moving them unless destructive relocation is explicitly required and confirmed.
- Add negative tests covering command separators, command substitution, leading option characters, absolute paths, traversal sequences, embedded newlines, and Unicode separator variants.