T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:59- Finding
Shell Command Injection Through Documented CLI Argument Construction
- Content
View full analysis
``` ```sh node {baseDir}/scripts/video_gen.js wait --json '{"model":"KLING_V3_0_PRO","prompt":"(full English prompt)","aspect_ratio":"9:16","duration":5,"generate_audio":true}' ``` ```sh node {baseDir}/scripts/video_gen.js wait --json '{"model":"KLING_V3_0_PRO","prompt":"(full English prompt)","image":"(user HTTPS URL)","aspect_ratio":"9:16","duration":5,"generate_audio":true}' ``` ### Technical Analysis The Skill directs an Agent to place user-influenced prompt and image URL values inside a JSON document that is itself enclosed in single quotes in a shell command. A single quote contained in an attacker-controlled value can terminate the shell argument before `scripts/video_gen.js` starts. The attacker can then append shell operators and arbitrary commands. Although `scripts/video_gen.js` parses the argument using `JSON.parse`, this does not mitigate the vulnerability. Shell tokenization and command substitution occur before Node.js receives the argument. Consequently, malformed or malicious content can be interpreted by the shell rather than rejected by the JSON parser. The vulnerable behavior is in the documented invocation pattern rather than an internal use of `child_process` by `video_gen.js`. Exploitation therefore depends on the invoking Agent constructing and executing the documented command through a shell with unescaped user content. ### Attack Path 1. An attacker requests video generation and su ...[truncated 1558 chars]- Remediation
View remediation