T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:68- Finding
Shell Command Injection Through Interpolated JSON Arguments
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:68-75; additional affected examples inresources/WERYAI_VIDEO_API.md:33-44
Vulnerability Type: Shell command injection caused by unsafe embedding of user-controlled prompt data
Risk Level: HighVulnerable Code
SKILL.md:68-75:markdown 6. `node {baseDir}/scripts/video_gen.js wait --json '…'`. 7. Return **`[Video](url)`**; no code fences around links. ## CLI reference ~~~sh node {baseDir}/scripts/video_gen.js wait --json '{"model":"KLING_V3_0_PRO","prompt":"…","duration":10,"aspect_ratio":"9:16","generate_audio":true,"negative_prompt":"illegible text, watermark, garbled captions"}' node {baseDir}/scripts/video_gen.js wait --json '{"model":"SEEDANCE_2_0","prompt":"…","duration":10,"aspect_ratio":"9:16","resolution":"720p","generate_audio":true}' ~~~resources/WERYAI_VIDEO_API.md:33-44:markdown node {baseDir}/scripts/video_gen.js wait --json '{"model":"KLING_V3_0_PRO","prompt":"...","duration":5,"aspect_ratio":"9:16"}' node {baseDir}/scripts/video_gen.js wait --json '{"model":"...","prompt":"...","image":"https://...","duration":5}' node {baseDir}/scripts/video_gen.js wait --json '{"model":"...","prompt":"...","images":["https://..."],"duration":5}' node {baseDir}/scripts/video_gen.js wait --json '...' --dry-run ## `submit-*` — submit only (async; no wait) ```sh node {baseDir}/scripts/video_gen.js submit-text --json '{"model":"…","prompt":"…","duration":5}' node {baseDir}/scripts/video_gen.js submit-image --json '{"model":"…","prompt":"…","image":"https://…","duration":5}' node {baseDir}/scripts/video_gen.js submit-multi-image --json '{"model":"…","prompt":"…","images":["https://…"],"duration":5}'Technical Analysis
The Skill requires an agent to expand a user-supplied topic into a prompt and then insert the resulting JSON into a single-quoted shell argument. JSON escaping and shell escaping are separate secur ...[truncated 2495 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not construct a shell command by concatenating or interpolating JSON containing user-controlled values.
- Invoke Node.js with an argument-array API that does not use a shell. For example, use an execution interface equivalent to:
javascript spawn( "node", [ `${baseDir}/scripts/video_gen.js`, "wait", "--json", JSON.stringify(parameters) ], { shell: false } ); - Prefer passing request data through standard input. Add an option such as
--json-stdin, read the complete JSON document from stdin, and invoke the program without embedding the document in shell syntax. - Alternatively, write the JSON to a securely created temporary file with restrictive permissions and pass only the file path as an argument. Ensure the file is created atomically, is not vulnerable to symlink attacks, and is deleted after use.
- Update
SKILL.mdandresources/WERYAI_VIDEO_API.mdso they do not instruct agents to interpolate expanded prompts into inline shell commands. - If a shell is unavoidable, apply a well-tested, platform-specific argument-escaping library to the complete argument. Simple replacement of apostrophes or JSON encoding alone is insufficient.
- Add regression tests using prompts containing apostrophes, quotes, semicolons, command substitutions, newlines, and shell control operators. Verify that every value reaches
video_gen.jsliterally and that no secondary process is launched. - Continue requiring explicit user confirmation of the expanded prompt, but do not treat confirmation as a substitute for safe process invocation.