T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:111
- Finding
- Execution of an Unverified Workspace Shell Script<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 111-114 **Vulnerability Type**: Unverified local script execution **Risk Level**: Medium ### Vulnerable Code ```markdown ### Gateway Health Check (Full) ```bash bash ./status.sh ``` ``` ### Technical Analysis The skill directs the agent to execute `status.sh` using a path relative to the current working directory. The audited project contains only `SKILL.md`; therefore, the referenced script is not bundled with the skill and its contents, provenance, and security properties cannot be verified. Because `./status.sh` is resolved from the process's current directory, its behavior depends on the environment in which the skill is invoked. A malicious or compromised workspace can supply its own `status.sh`. Explicitly launching the file with `bash` also bypasses the need for the file to have executable permissions. This is an unsafe trust-boundary assumption rather than evidence that the missing script is itself malicious. ### Attack Path 1. An attacker gains the ability to create or replace `status.sh` in the workspace from which the command will run. 2. The attacker places arbitrary shell commands in that file. 3. A user asks the agent to perform the documented full gateway health check. 4. The agent follows the skill instructions and executes `bash ./status.sh`. 5. The attacker's commands execute with the operating-system identity, environment variables, filesystem access, and network access available to the agent process. ### Impact Assessment Successful exploitation permits arbitrary command execution within the privileges of the account running the agent. Potential consequences include reading or modifying accessible gateway configuration, extracting credentials exposed through files or environment variables, altering agent behavior, and making network requests. The instruction does not independently obtain elevated privileges; its scope is limited to permissions already held by ...[truncated 26 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Bundle `status.sh` with the skill so that its complete implementation can be reviewed. - Resolve the script from a trusted, canonical skill directory rather than the current working directory. - Validate the script against a trusted cryptographic hash or signature before execution. - Refuse to execute the script if its ownership, location, or integrity does not match the expected values. - Run diagnostics under a minimally privileged account with a restricted environment and filesystem access. - Request explicit user approval before executing a script that is not part of the reviewed package. - Prefer implementing the required diagnostic operations directly through narrowly scoped, reviewed commands. ]]>