T09 · Insecure Skill Coding Practices
Error
- Location
- workflow.json:22
- Finding
- Shell Command Injection Through Unvalidated PR URL Components## Vulnerability Details **File Location**: `workflow.json`, lines 22 and 41 **Vulnerability Type**: OS command injection through unsafe string interpolation **Risk Level**: High ### Vulnerable Code ```json "command": "gh pr view ${prNumber} --repo ${owner}/${repo} --json title,body,state,author,createdAt,mergedAt,files,commits,additions,deletions", ``` ```json "command": "gh pr diff ${prNumber} --repo ${owner}/${repo} --no-color", ``` ### Technical Analysis The workflow constructs shell command strings by directly interpolating `prNumber`, `owner`, and `repo`, which are derived from the user-supplied PR URL. The configuration does not define strict validation, shell escaping, or argument-array execution for these values. If the `github` Skill passes the resulting command to a shell, an attacker can place shell metacharacters or command substitutions into a parsed URL component. The shell may then interpret part of the interpolated value as an additional command rather than as a literal GitHub identifier. Exploitability depends on the workflow engine and `github` Skill using shell-based command execution. Nevertheless, the configuration establishes an unsafe command-construction boundary and provides no controls that would prevent command injection. ### Attack Path 1. An attacker supplies a crafted value in the expected PR URL input. 2. The workflow extracts attacker-controlled text into `owner`, `repo`, or `prNumber`. 3. The extracted value is inserted directly into one of the `command` strings. 4. The `github` Skill executes the command through a shell. 5. Shell metacharacters or command substitutions are evaluated. 6. The injected command runs with the privileges and environment of the Agent process. ### Impact Assessment Successful exploitation could permit arbitrary command execution under the Agent's operating-system account. The attacker could read or modify files accessible to that account, access ...[truncated 345 chars]
- Remediation
- ## Remediation Suggestions 1. Parse the PR URL using a strict URL parser and require the hostname to be exactly `github.com` or an explicitly approved GitHub Enterprise hostname. 2. Validate repository owners and names against a restrictive allowlist such as `^[A-Za-z0-9_.-]+$`. 3. Require the PR number to match `^[0-9]+$` and convert it to an integer before use. 4. Execute `gh` directly with an argument array instead of constructing a shell command string. 5. If shell execution cannot be eliminated, apply context-appropriate shell escaping after validation; escaping must not replace validation. 6. Run the workflow in a minimally privileged sandbox with restricted filesystem and credential access. 7. Add negative tests covering semicolons, command substitution, newlines, option injection, traversal strings, and malformed URLs.