T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:226- Finding
Arbitrary Python Code Execution Through a Crafted Contract Filename
- Content
View full analysis
&1) echo "$result" | python3 -c " import sys,json data=json.load(sys.stdin) for d in data.get('dirs',[]): if d.get('name')=='$dir_name': print(d.get('id','')) break " 2>/dev/null } ``` ```bash CONTRACT_DIR_NAME="${FILE_NAME%.docx}" CONTRACT_DIR_GNS=$(check_dir_exists "$DATE_DIR_GNS" "$CONTRACT_DIR_NAME") ``` ### Technical Analysis The contract filename is treated as untrusted input and assigned to `CONTRACT_DIR_NAME`. The value is subsequently concatenated directly into the source code supplied to `python3 -c`: ```python if d.get('name')=='$dir_name': ``` Shell quoting does not protect values embedded into another interpreter's source code. A filename containing a single quote followed by valid Python syntax can terminate the string literal and alter the generated Python program. This is an interpreter injection vulnerability rather than ordinary shell injection. The injected payload executes under the same operating-system account and environment as the Skill workflow. ### Attack Path 1. An attacker creates or provides a contract with a maliciously crafted filename. 2. The user selects that contract as `LOCAL_FILE`. 3. `basename` preserves the attacker-controlled filename. 4. The workflow removes the `.docx` suffix and passes the remaining value to `check_dir_exists`. 5. `check_dir_exists` inserts the value directly into the `python3 -c` program. 6. The crafted filename closes th ...[truncated 884 chars]- Remediation
View remediation
&1) || return 1 printf '%s' "$result" | python3 -c ' import json import sys target_name = sys.argv[1] data = json.load(sys.stdin) for entry in data.get("dirs", []): if entry.get("name") == target_name: print(entry.get("id", "")) break ' "$dir_name" } ``` Additional hardening should include: 1. Validate that filenames do not contain control characters or path separators. 2. Treat filenames, directory names, API responses, and template contents as untrusted data. 3. Avoid constructing programs or expressions through string interpolation. 4. Check the exit status of both `mcporter` and the JSON parser. 5. Add regression tests using filenames containing quotes, newlines, backslashes, shell metacharacters, and Unicode edge cases. ]]>