SG-003: Direct Command Injection

Severity: CRITICAL

Skill content instructing AI to run Bash tool with dangerous arguments

Fires when

• Content instructs the AI to use the Bash tool to run, exec, or eval a command.
• The Bash tool is invoked alongside a fetch or decode utility such as curl, wget, nc, base64, or eval.
• The Write tool is directed to overwrite, modify, or replace system, config, or credential files.

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.

Research

• https://arxiv.org/abs/2406.05031