T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:20
- Finding
- Potential Shell Command Injection Through Untrusted Google Docs Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 20–27 **Vulnerability Type**: Shell command injection **Risk Level**: High **Vulnerable Code:** ```markdown THEN [Execute the native terminal command `gog docs write <docId> --text "..."` or `gog docs edit <docId> <find> <replace>`] ## Schema Example ```json { "command": "gog docs edit doc_id_123 \"old text\" \"new text\"" } ``` ``` ### Technical Analysis The skill instructs the agent to construct and execute a terminal command containing variable document IDs, search strings, replacement strings, and document text. It does not require validation, shell-safe escaping, or execution through a structured argument array. If an executor interpolates attacker-controlled values into the illustrated command string and passes it to a shell, embedded quotation marks, command substitutions, separators, redirections, or other shell metacharacters may terminate the intended argument context and introduce additional shell operations. Merely enclosing a value in double quotes is insufficient because shell constructs such as command substitution can still be interpreted, and injected quotes may alter command structure. Exploitability depends on the downstream agent using a shell-based command executor and incorporating untrusted input without safe argument handling. The file does not itself contain a malicious payload, but its command-construction guidance omits controls required to prevent injection. ### Attack Path 1. An attacker supplies a document ID, search value, replacement value, or text containing shell syntax. 2. The agent substitutes that value into the documented `gog docs write` or `gog docs edit` command template. 3. The assembled command is submitted to a shell rather than executed as a program with a structured argument list. 4. The shell interprets the injected syntax as commands, substitutions, redirections, or additional ...[truncated 741 chars]
- Remediation
- ## Remediation Suggestions - Require execution of `gog` directly through a structured argument array, without invoking a shell. For example, pass separate arguments equivalent to `["gog", "docs", "edit", docId, find, replace]`. - Prohibit construction of command strings through concatenation or interpolation of untrusted values. - Validate document identifiers against the narrow format accepted by Google Docs before execution. - Treat document text, search strings, and replacement strings as opaque data rather than command syntax. - Prefer stdin or a safely created input file for large text if the CLI supports either mechanism. - If shell invocation is unavoidable, use a platform-appropriate escaping library for every dynamic argument and reject control characters or unsupported syntax; manual quoting should not be relied upon. - Add explicit examples containing quotation marks, command substitutions, separators, and multiline text to verify that all values remain single literal arguments. - Document that confirmation and error output must not expose authentication tokens, document contents, or other sensitive command data.