T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:252- Finding
Arbitrary Shell Command Execution from Project-Controlled Tape Files
- Content
View full analysis
/dev/null; then echo "WARNING: Command may fail or hang: $cmd" fi done ``` ### Technical Analysis Commands are extracted from project-controlled VHS `Type` directives and passed directly to `bash -c`. The workflow does not impose an executable allowlist, reject shell metacharacters, request per-command authorization, or isolate execution in a sandbox. Because `bash -c` interprets the complete string as shell code, an attacker can use command substitution, pipelines, redirections, chained commands, environment expansion, or arbitrary executable invocations. The five-second timeout only limits runtime; it does not prevent commands from immediately deleting files, reading credentials, modifying the repository, or initiating network connections. The use of: ```bash for cmd in $(extract_commands "$tape_file") ``` also applies shell word splitting and pathname expansion to extracted commands, making validation behavior unreliable. However, the primary security issue is direct execution of repository-controlled strings through a shell. ### Attack Path 1. An attacker contributes or modifies a discovered `.tape` file. 2. The attacker places a malicious command in a `Type` directive, for example a command that reads local configuration or modifies project files. 3. A user or agent invokes the tutorial-update workflow on the repository. 4. The validation phase calls `extract_comman ...[truncated 888 chars]- Remediation
View remediation
`. 5. Require explicit user approval for every command that cannot be validated against a trusted policy. 6. If behavioral execution is essential, use an ephemeral container or virtual machine with: - A read-only source workspace - No host credential mounts - Network access disabled by default - A nonprivileged user - Resource and process limits - A disposable output directory 7. Replace the word-splitting loop with a line-preserving construct such as `while IFS= read -r cmd`. 8. Treat the timeout as availability protection only, not as a security control. ]]>