Support dynamic command expansion in skills (\!command syntax)
#2116
+297
−31
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| package skills | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "context" | ||
| "fmt" | ||
| "io" | ||
| "log/slog" | ||
| "os/exec" | ||
| "regexp" | ||
| "strings" | ||
| "time" | ||
| ) | ||
|
|
||
| // commandTimeout is the maximum time allowed for a single command expansion. | ||
| const commandTimeout = 30 * time.Second | ||
|
|
||
| // maxOutputSize is the maximum number of bytes read from a command's stdout. | ||
| const maxOutputSize = 1 << 20 // 1 MB | ||
|
|
||
| // commandPattern matches the !`command` syntax used by Claude Code skills | ||
| // to embed dynamic command output into skill content. | ||
| var commandPattern = regexp.MustCompile("!`([^`]+)`") | ||
|
|
||
| // ExpandCommands replaces all !`command` patterns in the given content | ||
| // with the stdout of executing each command via the system shell. | ||
| // Commands are executed with the specified working directory. | ||
| // If a command fails, the pattern is replaced with an error message | ||
| // rather than failing the entire expansion. | ||
| func ExpandCommands(ctx context.Context, content, workDir string) string { | ||
| return commandPattern.ReplaceAllStringFunc(content, func(match string) string { | ||
| command := match[2 : len(match)-1] // strip leading !` and trailing ` | ||
|
|
||
| output, err := runCommand(ctx, command, workDir) | ||
| if err != nil { | ||
| slog.Warn("Skill command expansion failed", "command", command, "error", err) | ||
| return fmt.Sprintf("[error executing `%s`: %s]", command, err) | ||
| } | ||
|
|
||
| return strings.TrimRight(output, "\n") | ||
| }) | ||
| } | ||
|
|
||
| // runCommand executes a shell command and returns its stdout (up to maxOutputSize bytes). | ||
| // The command runs in the specified working directory. | ||
| func runCommand(ctx context.Context, command, workDir string) (string, error) { | ||
| ctx, cancel := context.WithTimeout(ctx, commandTimeout) | ||
| defer cancel() | ||
|
|
||
| cmd := exec.CommandContext(ctx, "sh", "-c", command) | ||
| cmd.Dir = workDir | ||
|
|
||
| var stderr bytes.Buffer | ||
| cmd.Stderr = &stderr | ||
|
|
||
| stdout, err := cmd.StdoutPipe() | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| if err := cmd.Start(); err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| out, err := io.ReadAll(io.LimitReader(stdout, maxOutputSize)) | ||
|
There was a problem hiding this comment. If Issue: Recommendation: out, err := io.ReadAll(io.LimitReader(stdout, maxOutputSize))
if err != nil {
cmd.Process.Kill()
cmd.Wait() // Clean up the process
return "", err
}Or use |
||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| // Drain any remaining stdout so the process doesn't block on a full pipe | ||
| // and hang until the context timeout kills it. | ||
| _, _ = io.Copy(io.Discard, stdout) | ||
|
There was a problem hiding this comment. After reading Issue: Recommendation: if ctx.Err() != nil {
cmd.Process.Kill()
return "", ctx.Err()
}
_, _ = io.Copy(io.Discard, stdout) |
||
|
|
||
| if err := cmd.Wait(); err != nil { | ||
| if ctx.Err() == context.DeadlineExceeded { | ||
|
There was a problem hiding this comment. The code checks Issue: Recommendation: if err := cmd.Wait(); err != nil {
if errors.Is(ctx.Err(), context.DeadlineExceeded) {
return "", fmt.Errorf("command timed out after %s", commandTimeout)
}
// ... rest of error handling
} |
||
| return "", fmt.Errorf("command timed out after %s", commandTimeout) | ||
| } | ||
| if stderrMsg := strings.TrimSpace(stderr.String()); stderrMsg != "" { | ||
| return "", fmt.Errorf("%w: %s", err, stderrMsg) | ||
| } | ||
| return "", err | ||
| } | ||
|
|
||
| return string(out), nil | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| package skills | ||
|
|
||
| import ( | ||
| "context" | ||
| "os" | ||
| "path/filepath" | ||
| "runtime" | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| "github.com/stretchr/testify/require" | ||
| ) | ||
|
|
||
| func skipOnWindows(t *testing.T) { | ||
| t.Helper() | ||
| if runtime.GOOS == "windows" { | ||
| t.Skip("skipping on windows") | ||
| } | ||
| } | ||
|
|
||
| func TestExpandCommands(t *testing.T) { | ||
| skipOnWindows(t) | ||
|
|
||
| tests := []struct { | ||
| name string | ||
| content string | ||
| want string | ||
| }{ | ||
| { | ||
| name: "no patterns", | ||
| content: "# My Skill\n\nJust regular markdown content.", | ||
| want: "# My Skill\n\nJust regular markdown content.", | ||
| }, | ||
| { | ||
| name: "simple echo", | ||
| content: "Hello !`echo world`!", | ||
| want: "Hello world!", | ||
| }, | ||
| { | ||
| name: "multiple commands", | ||
| content: "Name: !`echo alice`, Age: !`echo 30`", | ||
| want: "Name: alice, Age: 30", | ||
| }, | ||
| { | ||
| name: "multiline output", | ||
| content: "Files:\n!`printf 'a.go\nb.go\nc.go\n'`\nEnd.", | ||
| want: "Files:\na.go\nb.go\nc.go\nEnd.", | ||
| }, | ||
| { | ||
| name: "empty output", | ||
| content: "Before !`true` after", | ||
| want: "Before after", | ||
| }, | ||
| { | ||
| name: "pipes", | ||
| content: "Count: !`printf 'a\nb\nc\n' | wc -l | tr -d ' '`", | ||
| want: "Count: 3", | ||
| }, | ||
| { | ||
| name: "preserves regular backticks", | ||
| content: "Use `echo hello` to print.\n\nCode: ```go\nfmt.Println()\n```", | ||
| want: "Use `echo hello` to print.\n\nCode: ```go\nfmt.Println()\n```", | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| result := ExpandCommands(t.Context(), tt.content, t.TempDir()) | ||
| assert.Equal(t, tt.want, result) | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func TestExpandCommands_WorkingDirectory(t *testing.T) { | ||
| skipOnWindows(t) | ||
|
|
||
| tmpDir := t.TempDir() | ||
| require.NoError(t, os.WriteFile(filepath.Join(tmpDir, "test.txt"), []byte("hello"), 0o644)) | ||
|
|
||
| result := ExpandCommands(t.Context(), "Content: !`cat test.txt`", tmpDir) | ||
| assert.Equal(t, "Content: hello", result) | ||
| } | ||
|
|
||
| func TestExpandCommands_ScriptExecution(t *testing.T) { | ||
| skipOnWindows(t) | ||
|
|
||
| tmpDir := t.TempDir() | ||
| require.NoError(t, os.WriteFile(filepath.Join(tmpDir, "info.sh"), []byte("#!/bin/sh\necho from-script"), 0o755)) | ||
|
|
||
| result := ExpandCommands(t.Context(), "Output: !`./info.sh`", tmpDir) | ||
| assert.Equal(t, "Output: from-script", result) | ||
| } | ||
|
|
||
| func TestExpandCommands_FailedCommand(t *testing.T) { | ||
| skipOnWindows(t) | ||
|
|
||
| result := ExpandCommands(t.Context(), "Before !`nonexistent_command_12345` after", t.TempDir()) | ||
| assert.Contains(t, result, "Before ") | ||
| assert.Contains(t, result, "[error executing `nonexistent_command_12345`:") | ||
| assert.Contains(t, result, " after") | ||
| } | ||
|
|
||
| func TestExpandCommands_CancelledContext(t *testing.T) { | ||
| skipOnWindows(t) | ||
|
|
||
| ctx, cancel := context.WithCancel(t.Context()) | ||
| cancel() | ||
|
|
||
| result := ExpandCommands(ctx, "Result: !`echo hello`", t.TempDir()) | ||
| assert.Contains(t, result, "[error executing `echo hello`:") | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔴 CRITICAL: Arbitrary Command Execution Without Sandboxing
The
runCommandfunction executes arbitrary shell commands from SKILL.md files usingexec.CommandContextwithsh -c. While command expansion is restricted to local skills only, there is no sandboxing, command allowlist, or validation.Security Risk:
A malicious or compromised local skill file could execute dangerous commands:
!\- filesystem destructionThese commands would execute with full docker-agent process privileges.
Recommendation:
--allow-skill-commandsflag