T09 · Insecure Skill Coding Practices
- Location
scripts/detect_bot_info.sh:16- Finding
Arbitrary Python Code Execution Through Unsafe Data Interpolation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/detect_bot_info.sh, lines 16–52
Vulnerability Type: Python source injection
Risk Level: HighVulnerable Code
bash # Extract bot token from config BOT_TOKEN=$(python3 -c " import json, sys with open('$CONFIG_PATH') as f: cfg = json.load(f) # Support single account or multi-account tg = cfg.get('channels', {}).get('telegram', {}) token = tg.get('botToken', '') if not token: # Try first account accounts = tg.get('accounts', {}) for acc in accounts.values(): token = acc.get('botToken', '') if token: break if not token: print(json.dumps({'error': 'No Telegram bot token found in config'}), file=sys.stderr) sys.exit(1) print(token) ") # Call Telegram getMe API RESPONSE=$(curl -s "https://api.telegram.org/bot${BOT_TOKEN}/getMe") # Parse and output python3 -c " import json, sys data = json.loads('''$RESPONSE''') if not data.get('ok'): print(json.dumps({'error': 'Telegram API error', 'details': data}), file=sys.stderr) sys.exit(1) result = data['result'] print(json.dumps({ 'id': result['id'], 'name': result.get('first_name', ''), 'username': result.get('username', ''), 'can_join_groups': result.get('can_join_groups', False), 'can_read_all_group_messages': result.get('can_read_all_group_messages', False) })) "Technical Analysis
The script embeds two variable values directly into source code passed to
python3 -c:CONFIG_PATHis inserted into the expressionwith open('$CONFIG_PATH').- The complete Telegram API response is inserted into
json.loads('''$RESPONSE''').
Shell quoting does not make these values safe within the resulting Python program. A single quote in
CONFIG_PATH, or a triple-single-quote sequence followed by Python syntax inRESPONSE, can terminate the intended Python string literal. T ...[truncated 2659 chars]- Remediation
View remediation
Remediation Suggestions
Never place variable data inside dynamically generated Python source. Pass the configuration path as a positional argument:
bash BOT_TOKEN=$(python3 - "$CONFIG_PATH" <<'PY' import json import sys with open(sys.argv[1], encoding="utf-8") as config_file: cfg = json.load(config_file) tg = cfg.get("channels", {}).get("telegram", {}) token = tg.get("botToken", "") if not token: accounts = tg.get("accounts", {}) for account in accounts.values(): token = account.get("botToken", "") if token: break if not token: print( json.dumps({"error": "No Telegram bot token found in config"}), file=sys.stderr, ) sys.exit(1) print(token) PY )Pass the API response through standard input so that the JSON parser receives it strictly as data:
bash RESPONSE=$(curl --fail --show-error --silent \ "https://api.telegram.org/bot${BOT_TOKEN}/getMe") printf '%s' "$RESPONSE" | python3 -c ' import json import sys data = json.load(sys.stdin) if not data.get("ok"): print( json.dumps({ "error": "Telegram API error", "details": data, }), file=sys.stderr, ) sys.exit(1) result = data["result"] print(json.dumps({ "id": result["id"], "name": result.get("first_name", ""), "username": result.get("username", ""), "can_join_groups": result.get("can_join_groups", False), "can_read_all_group_messages": result.get("can_read_all_group_messages", False), })) 'Additional hardening should include:
- Use
curl --fail --show-error --silentso HTTP and transport errors cause a failure. - Set explicit connection and total timeouts.
- Validate that the response content type and structure match the expected Telegram API schema.
- Avoid logging the bot token or request URL because the token i ...[truncated 257 chars]
- Use