SD-001 — Shell Injection
SD-001 flags eval with variable input or backtick command substitution containing a variable in supported shell, script or fenced Markdown content.
What it matches
A variable expansion passed through eval, or backtick command substitution containing a variable, in supported shell/script content. In Markdown, only shell-tagged or untagged code fences are checked.
Why it matters
If an agent or hook executes the matched command, an attacker who controls the interpolated value may control what runs because the shell parses substituted text as syntax rather than data. The effect depends on the runtime's privileges, sandbox and approvals; the static finding does not observe execution.
Example
bash
# SKILL.md tells the agent to run: eval "grep -r $USER_QUERY ./notes" SUMMARY=`wc -l $TARGET_FILE`
The value is interpolated into shell syntax, not passed as an argument.
How to fix it
Pass values as arguments rather than splicing them into a command string, and quote every expansion. If supported instructions or scripts genuinely need to build a command, restrict it to a fixed list of allowed subcommands instead of accepting free text.
Known false positives
Prose that quotes a dangerous command while explaining it. Documentation and an instruction are the same bytes in a supported file.
Standards mapping
OWASP ASI ASI05
CWE CWE-78
Prevalence
Pattern SD-001 was detected in 114 of 16996 public skills scanned as of 27 October 2026.
current ruleset eb11e25d39bc2c81
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.