T09 · Insecure Skill Coding Practices
Error
- Location
generate_prompt.sh:22- Finding
Untrusted Arguments Are Interpolated into Executable Python Source
- Content
View full analysis
"$ENV_FILE" ``` The same unsafe construction appears in other scripts. For example: ```bash python3 << PYEOF import re, sys try: with open("$FRAMEWORK_FILE") as f: text = f.read() ``` ```bash python3 -c " import json print(json.dumps({'bot_token': '''$BOT_TOKEN''', 'chat_id': '$TARGET'})) " > "$KEY_TMPFILE" ``` ```bash python3 << PYEOF import json, urllib.request, time, sys with open("$KEY_TMPFILE") as f: env = json.load(f) with open("$MSG_FILE") as f: text = f.read() ``` ### Technical Analysis Shell variables are expanded directly into Python programs passed through `python3 -c` or unquoted heredocs. Quoting a value with Python triple quotes does not make it safe. An argument containing triple-quote delimiters or a filename containing quotation marks and Python syntax can terminate the intended string and introduce an arbitrary Python expression or statement. Affected externally supplied values include: - `FRAMEWORK_FILE` and `IMAGE_FILE` in `generate_prompt.sh` - `FRAMEWORK_FILE` in `extract_ratio.sh` - `ASPECT_RATIO` in `generate_image.sh` - `TARGET` in `send.sh` - `MSG_FILE` and `TARGET` in `send_text.sh` For triple-quoted fields, a value shaped like the following can introduce expression evaluation: ```text ''' + (__import__('os').system('ATTACKER_COMMAND') or '') + ''' ``` For a value placed inside a normal double-quoted Python string, a quotation mark followed by Python statements can escape the string. This is not re ...[truncated 1629 chars]- Remediation
View remediation