T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:55
- Finding
- Untrusted VHS Tape Files Can Execute Arbitrary Shell Commands## Vulnerability Details **File Location**: `SKILL.md:55-63, 81-84`; `modules/execution.md:43-55, 84-87`; `modules/tape-syntax.md:61-75, 111-118, 178-183` **Vulnerability Type**: Execution of insufficiently validated command-bearing files **Risk Level**: High ### Vulnerable Code `SKILL.md:55-63`: ```markdown ### Phase 1: Validate Tape File 1. Confirm tape file exists at specified path 2. Read tape file contents 3. Verify required directives: - `Output` directive specifies GIF destination - At least one action command (Type, Enter, etc.) ``` `SKILL.md:81-84`: ```markdown ### Phase 3: Execute Recording ```bash vhs <tape-file.tape> ``` ``` `modules/execution.md:43-55`: ```markdown ### Tape File Validation Check tape file before execution: ```bash # Verify file exists test -f tape-file.tape && echo "Found" || echo "Missing" # Check for Output directive rg -q "^Output" tape-file.tape && echo "Has output" || echo "No output directive" # fallback: grep -q "^Output" tape-file.tape # Validate syntax (dry run) vhs validate tape-file.tape ``` ``` `modules/execution.md:84-87`: ```markdown ### Basic Execution ```bash vhs tape-file.tape ``` ``` `modules/tape-syntax.md:61-75`: ```markdown ### Type Types text into the terminal: ```tape Type "echo 'Hello World'" Type@50ms "slower typing" ``` ### Enter Sends Enter key (execute command): ```tape Enter ``` ``` `modules/tape-syntax.md:111-118`: ```markdown ### Hide/Show Control visibility of actions: ```tape Hide Type "secret setup commands" Enter Show ``` ``` `modules/tape-syntax.md:178-183`: ```markdown ### Source Include other tape files: ```tape Source common-setup.tape ``` ``` ### Technical Analysis VHS tape files are executable terminal automation definitions. A `Type` directive places attacker-controlled text into th ...[truncated 2380 chars]
- Remediation
- ## Remediation Suggestions 1. Treat every tape file as executable code rather than passive recording input. 2. Require explicit user approval before executing tapes from external, downloaded, generated, or otherwise untrusted sources. 3. Display all executable `Type`/`Enter` sequences to the user before execution, including actions enclosed by `Hide`. 4. Resolve every `Source` directive and recursively review the complete inclusion graph. Reject missing files, inclusion cycles, path traversal, and references outside an approved project directory. 5. Canonicalize and validate `Output` and `Screenshot` paths. Restrict generated files to an explicitly approved output directory. 6. Run untrusted tapes in a disposable sandbox or container with a read-only project mount, a dedicated writable output directory, no host credentials, minimal environment variables, and network access disabled by default. 7. Add policy checks for destructive or sensitive commands. Such checks should supplement sandboxing rather than replace it because shell syntax can bypass simple deny lists. 8. Document that syntax validation confirms only VHS grammar and does not establish the safety of commands. 9. Avoid exposing sensitive values in the terminal environment and use a dedicated low-privilege account for recording.