T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:20
- Finding
- Shell Command Injection Through an Untrusted Document Title<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 20 **Vulnerability Type**: OS command injection through unsafe command construction **Risk Level**: High ### Vulnerable Code ```markdown ## Cognitive Directives WHEN [A new Google Doc needs to be created] THEN [Execute the native terminal command `gog docs create <title> --json`] ## Schema Example ```json { "command": "gog docs create \"My New Document\" --json" } ``` ``` ### Technical Analysis The skill instructs the agent to interpolate a document title directly into a terminal command. It does not require structured process invocation, strict title validation, or shell-safe argument escaping. Even if the title is surrounded by double quotes as suggested by the example, shell syntax such as command substitution remains active inside double-quoted strings. A title containing shell metacharacters could therefore alter the command or cause an additional command to execute. For example, a malicious title resembling the following could trigger command substitution if inserted into a shell command: ```text $(id) ``` The resulting command could resemble: ```sh gog docs create "$(id)" --json ``` The shell would run `id` before invoking `gog`. Quote-breaking payloads could similarly append independent commands. Exploitability applies when the agent receives an attacker-controlled title and executes the generated command through a shell rather than passing arguments directly to the executable. ### Attack Path 1. An attacker supplies or influences the requested Google Document title. 2. The title contains shell control syntax, command substitution, or quote-breaking characters. 3. The agent follows the skill directive and substitutes the title into the command template. 4. The generated command is submitted to a shell-enabled terminal tool. 5. The shell interprets the injected syntax and executes attacker-selected commands with the agent process's privileges. ### Impact Assessment Suc ...[truncated 540 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not construct a shell command by concatenating or interpolating the title. - Invoke `gog` through a structured subprocess API with a fixed argument array, equivalent to: ```text ["gog", "docs", "create", user_supplied_title, "--json"] ``` - Explicitly prohibit shell evaluation and avoid APIs that implicitly invoke `/bin/sh`, such as shell-enabled execution modes. - If only a terminal string interface is available, apply robust platform-specific argument escaping to every untrusted value. Simple double-quoting is insufficient. - Validate the title against documented Google Docs requirements and reject control characters, line breaks, and unexpected shell metacharacters where they are not legitimately needed. - Update the directive to distinguish command arguments from shell source code. For example: ```markdown Invoke the `gog` executable directly with argument array `["docs", "create", title, "--json"]`. Do not execute through a shell and do not concatenate `title` into a command string. ``` - Add security tests using titles containing spaces, quotes, semicolons, command substitutions, redirection symbols, and newlines. Confirm that every test value is passed to `gog` as one literal argument and never interpreted by a shell. ]]>