T09 · Insecure Skill Coding Practices
Error
- Location
examples/react-example.js:42- Finding
Arbitrary JavaScript Execution Through the ReAct Calculator Tool
- Content
View full analysis
{ console.log(` [Tool: calculate] Expression: ${expression}`); try { // The implementation claims this is safe, but eval executes arbitrary JavaScript. const result = eval(expression); return result.toString(); } catch (error) { return `Calculation error: ${error.message}`; } } } ``` The documentation reproduces the vulnerable implementation: ```javascript calculate: { description: 'Execute mathematical calculations', execute: async ({ expression }) => { return eval(expression).toString(); } } ``` ### Technical Analysis The calculator passes the `expression` argument directly to JavaScript's `eval()` function. `eval()` does not restrict input to arithmetic syntax; it evaluates arbitrary JavaScript in the Node.js process. The ReAct execution flow makes this sink security-sensitive: 1. A task is included in an LLM prompt. 2. The LLM generates a JSON action containing a tool name and arguments. 3. `ReActAgent.observe()` resolves the selected tool and invokes `tool.execute(action.args)`. 4. If the selected tool is `calculate`, the LLM-generated `expression` reaches `eval()` without validation or isolation. Consequently, prompt injection, a malicious user task, or a compromised LLM response can transform a calculator action into arbitrary code execution. Catching exceptions does not mitigate the vulnerability because execution occurs before any error is handled. The source agent does not itself contain `eval()`, but it intentionally executes calle ...[truncated 2018 chars]- Remediation
View remediation