T09 · Insecure Skill Coding Practices
Error
- Location
- modules/dependency-graph.md:12
- Finding
- Unsafe GNU Make Inspection Enables Parse-Time Command Execution<![CDATA[ ## Vulnerability Details **File Location**: `modules/dependency-graph.md`, lines 12–15 **Vulnerability Type**: Unsafe evaluation of untrusted Makefiles **Risk Level**: High ### Vulnerable Code ```markdown Inspect the complete expanded database: ```bash make -pn | less ``` ``` ### Technical Analysis The skill recommends `make -pn` as a Makefile inspection command. Although `-n` prevents ordinary recipes from being executed, GNU Make still parses and expands the Makefile to construct its database. Parse-time expressions such as `$(shell command)` can execute operating-system commands during this process. Consequently, this command is not a safe static-analysis mechanism for repositories whose Makefiles are untrusted. A malicious Makefile can execute a payload merely by being inspected, without requiring the auditor to invoke an explicit build target. For example, an attacker-controlled Makefile could contain: ```makefile AUDIT := $(shell attacker-controlled-command) ``` When the documented inspection command loads that Makefile, GNU Make evaluates the `shell` function and runs the embedded command. ### Attack Path 1. An attacker supplies or modifies a repository containing a malicious `Makefile` or included `.mk` file. 2. The Makefile places an attacker-controlled command in a parse-time GNU Make expression, such as `$(shell ...)`. 3. An agent loads this skill to audit the repository. 4. Following `modules/dependency-graph.md`, the agent runs: ```bash make -pn | less ``` 5. GNU Make parses and expands the malicious Makefile. 6. The parse-time expression executes with the privileges and environment of the auditing agent. ### Impact Assessment Successful exploitation provides arbitrary command execution under the auditing process's existing user account. The payload could: - Read files and environment variables accessible to the agent, including credentials present in its environment. - Modify or delete files writable by the agen ...[truncated 417 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `make -pn` from the default workflow for untrusted repositories. 2. Perform initial inspection using non-evaluating text-analysis tools or a parser that does not execute Make functions. 3. Treat the main Makefile, recursively included files, generated include files, and command-line-provided makefiles as untrusted input. 4. If semantic GNU Make evaluation is indispensable: - Require explicit user approval before execution. - Run GNU Make in an ephemeral sandbox or container. - Disable network access. - Exclude credentials, SSH agents, cloud tokens, and other secrets from the environment. - Mount the repository read-only and avoid writable host paths. - Run as an unprivileged user with strict CPU, memory, process, and execution limits. 5. Add a prominent warning that `-n` does not prevent parse-time execution through GNU Make functions. 6. Before any semantic evaluation, statically search for dangerous constructs such as `$(shell ...)`, included makefiles, and other expansion-time behavior. This screening should supplement isolation rather than replace it. ]]>