T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:20
- Finding
- Potential Command Injection Through an Unvalidated Document ID<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20–26 **Vulnerability Type**: Command injection caused by unsafe command construction **Risk Level**: High ### Vulnerable Code ```markdown ## Cognitive Directives WHEN [The contents of a Google Doc need to be read] THEN [Execute the native terminal command `gog docs cat <docId>`] ## Schema Example ```json { "command": "gog docs cat doc_id_123" } ``` ``` ### Technical Analysis The skill directs the agent to interpolate a document ID into the command string `gog docs cat <docId>`. It does not require validation, shell-safe quoting, or invocation through a structured argument array. If the document ID is attacker-controlled and the generated command is passed through a command shell, shell metacharacters can terminate or extend the intended command. The `gog` operation itself is consistent with the skill's declared purpose; the vulnerability arises from the unspecified and potentially unsafe handling of the dynamic `docId` value. For example, a value containing a command separator could cause the shell to interpret trailing text as another command rather than as a Google document identifier. Exploitability therefore depends on whether the calling agent uses a shell and permits an attacker to influence the identifier. ### Attack Path 1. An attacker supplies or influences the Google document ID presented to the agent. 2. The attacker includes shell syntax in the value, such as `valid_id; attacker_command`. 3. The agent substitutes that value into the documented command template. 4. The resulting command is executed through a shell. 5. The shell runs the appended command with the privileges of the agent process. ### Impact Assessment Successful exploitation could permit arbitrary local command execution under the account running the agent. Depending on that account's privileges and environment, an attacker could read accessible local files and credentials, modify project or user dat ...[truncated 246 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate the document ID against a strict allowlist before invoking `gog`. For example, accept only values matching `^[A-Za-z0-9_-]+$`. 2. Reject whitespace, control characters, command separators, redirection operators, substitutions, and other shell metacharacters. 3. Execute the CLI without a shell, using a structured argument array equivalent to: ```text ["gog", "docs", "cat", docId] ``` 4. Update the skill instructions to explicitly prohibit concatenating user-controlled values into shell command strings. 5. Return a validation error without executing the command when the supplied identifier does not match the expected format. 6. Run the CLI with the minimum filesystem, credential, and network permissions required to read the requested Google document. ]]>