T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:14
- Finding
- PowerShell Execution Policy Is Weakened Beyond the Required Scope<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:14-18` - `README.md:58-70` **Vulnerability Type**: Broad and persistent weakening of PowerShell execution-policy protections **Risk Level**: Medium ### Vulnerable Code `SKILL.md:14-18` ```markdown ## Setup ```powershell Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned ``` ``` `README.md:58-70` ```markdown ### Execution Policy If scripts are blocked (`UnauthorizedAccess` error), set the execution policy: ```powershell Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned ``` Or run one-off with bypass: ```powershell powershell -ExecutionPolicy Bypass -File .\powerskills.ps1 list ``` ``` ### Technical Analysis The setup documentation instructs users to change the execution policy for their entire Windows account to `RemoteSigned`. This is a persistent, user-wide configuration change that applies to unrelated PowerShell scripts after the skill has finished. The documented alternative starts PowerShell with `ExecutionPolicy Bypass`, disabling execution-policy checks for that process. This is especially concerning because the artifact does not contain the referenced `powerskills.ps1` file or any advertised implementation scripts. Consequently, the executable content users are instructed to run cannot be reviewed or verified from the supplied package. PowerShell execution policy is not a complete security boundary, but weakening it broadly removes a defense-in-depth control and makes execution of substituted, downloaded, or tampered scripts easier. ### Attack Path 1. A user follows the documented setup and applies `RemoteSigned` at `CurrentUser` scope, or launches PowerShell with `ExecutionPolicy Bypass`. 2. The user obtains the absent `powerskills.ps1` script from another source or executes a substituted file with the expected name. 3. The script runs under the reduced execution-policy restrictions with the user's existing permissions. 4. A malicious ...[truncated 942 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not recommend a persistent, account-wide execution-policy change as routine setup. 2. Remove the `ExecutionPolicy Bypass` example. 3. Include every referenced PowerShell script in the audited package so users can verify exactly what will execute. 4. Digitally sign release scripts with a trusted code-signing certificate. 5. Publish cryptographic checksums for release artifacts and document how users should verify them. 6. If an override is genuinely unavoidable, use the narrowest possible process-scoped configuration and explain its security implications. 7. Restore any temporary policy setting immediately after execution. 8. Advise users to obtain scripts only from an authenticated release channel and never run a same-named script from an unverified working directory. ]]>