T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:216
- Finding
- Unsafe User-Controlled Value Interpolation in Shell and Inline Python Commands## Vulnerability Details **File Location**: `SKILL.md`, lines 216-243 **Vulnerability Type**: Command injection and inline Python code injection **Risk Level**: High ### Vulnerable Code ```text **Fallback 1: Static image generation failure** ``` Trigger condition: image_synthesize returns an error or produces an image with extremely poor quality Fallback action: switch to nano-banana-pro uv run ~/.codex/skills/nano-banana-pro/scripts/generate_image.py \ --prompt "[Original prompt, simplified and without the resolution parameter]" \ --filename "/workspace/fmt_page_[N]_[Topic].png" \ --resolution 4K After recovery: continue the original workflow ``` **Fallback 2: Dynamic video generation failure** ``` Trigger condition: gen_videos returns an error or produces a corrupted output file Fallback action: switch to batch_image_to_video batch_image_to_video({ count: 1, image_file_list: ["/workspace/fmt_page_[N]_[Topic].png"], output_file_list: ["/workspace/fmt_page_[N]_[Topic]_HD.mp4"], prompt_list: ["[Simplified dynamic prompt without resolution instructions]"], duration_list: [6], resolution_list: ["768P"] }) After recovery: notify the user that the video is a 768P fallback version ``` ``` The original source uses Chinese placeholder names and explanatory text; the excerpt above is translated into English to satisfy the report language requirement while preserving the command structure. ### Technical Analysis The skill accepts user-provided page topics and prompt content, then instructs the agent to substitute those values into command-line arguments, quoted file paths, and API-call string literals. It does not define validation, escaping, canonicalization, or a safe argument-array execution mechanism. Double quotes do not make shell interpolation universally safe. If an attacker-controlled topic or prompt contains shell metacharacters or command-substit ...[truncated 2411 chars]
- Remediation
- ## Remediation Suggestions 1. **Do not construct shell commands through textual interpolation.** Invoke programs with an argument-array API such as Python `subprocess.run([...], shell=False, check=True)` so user values are passed as data rather than parsed as shell syntax. 2. **Generate safe internal identifiers.** Do not place raw page topics in filesystem paths. Derive filenames from trusted page numbers, UUIDs, or strictly sanitized slugs. 3. **Apply allowlist validation.** Restrict page numbers to integers and topics used in filenames to an explicitly permitted character set and length. Reject path separators, control characters, quotes, shell metacharacters, and traversal components such as `..`. 4. **Keep display text separate from paths.** Store the original user-facing topic only in structured metadata. Use a generated identifier for files and directories. 5. **Eliminate `python3 -c` with interpolated content.** Place fallback logic in a fixed script and pass values through validated command-line arguments, standard input, or a JSON file. Parse those values as data. 6. **Use structured API parameters.** When calling image or video tools, construct native objects and serialize them with a trusted JSON encoder rather than assembling JavaScript-like snippets manually. 7. **Enforce path containment.** Resolve every output path and verify that it remains beneath the intended `/workspace/fmt_pages` root before creating or modifying files. 8. **Run with least privilege.** Execute media-generation fallbacks in a restricted environment with minimal filesystem access, no unnecessary credentials, and constrained network access. 9. **Add adversarial tests.** Test topics containing quotes, command-substitution characters, path separators, traversal sequences, newlines, and Unicode edge cases. Verify that they are rejected or treated solely as inert data.