T09 · Insecure Skill Coding Practices
- Location
SKILL.md:104- Finding
Untrusted Generated Code Is Executed Without Isolation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 104-134
Vulnerability Type: Unsafe execution of assignment-derived generated code
Risk Level: HighVulnerable instructions:
markdown ### Step 3: 写代码 **AI 任务**: 1. 根据方案设计编写完整可运行的 Python 代码 2. 自带 mock 数据（不依赖外部 API 或付费数据集） 3. 代码必须能生成图表（matplotlib/seaborn） 4. 包含清晰注释和 docstring 5. 写 `requirements.txt` **输出**： - `output/code/main.py` — 主程序 - `output/code/requirements.txt` — 依赖 **约束**： - 代码必须能 `python main.py` 一键运行 - 图片输出到 `output/figures/` - 不使用需要 API key 的服务 --- ### Step 4: 验证运行 **AI 任务**: 1. 实际运行 `output/code/main.py` 2. 确认无报错 3. 确认图片已生成到 `output/figures/` 4. 如果报错：修复代码 → 重跑，最多 3 次Technical Analysis
The Skill treats assignment material as the specification for generating a Python program and subsequently directs the agent to execute that program. Assignment content is externally controlled and may contain adversarial requirements or prompt-injection text designed to make the generated program perform operations unrelated to the academic task.
The instructions do not require a security review, user confirmation, sandbox, filesystem allowlist, network restriction, process timeout, resource limit, or reduced-privilege execution environment. The prohibition on services requiring API keys does not prevent ordinary outbound connections, local file access, subprocess creation, or destructive filesystem operations.
The bundled
scripts/workflow_runner.pyonly writes a template and does not execute it. The vulnerable execution path arises from the agent workflow mandated bySKILL.md, rather than an automatic subprocess call in the bundled runner.Attack Path
- An attacker supplies an assignment document containing malicious or disguised implementation requirements.
- The agent processes those requirements during analysis and solution design.
- In Step 3, the agent incorporates attacker-influenced be ...[truncated 913 chars]
- Remediation
View remediation
Remediation Suggestions
- Explicitly classify all assignment documents and user-provided project requirements as untrusted data.
- Add a non-overridable instruction stating that assignment content cannot redefine workflow rules, request unrelated system operations, or weaken security controls.
- Require a security review of generated code before execution. Review file operations, process creation, dynamic imports, deserialization, network activity, and access to environment variables.
- Require explicit user approval before running generated programs.
- Execute generated code in an ephemeral sandbox or container with:
- No mounted credentials or host secrets.
- Read-only access to required inputs.
- Write access limited to a dedicated output directory.
- Outbound network access disabled by default.
- No access to host process or administrative interfaces.
- CPU, memory, file-size, process-count, and execution-time limits.
- A non-privileged user identity.
- Maintain an allowlist of permitted libraries and capabilities for generated programs.
- Do not automatically retry code that triggers security-policy violations.