T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/python_relay.py:7
- Finding
- Caller-Controlled Environment Variable Bypasses the Claimed Human Authorization Gate<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15-18`, `scripts/main_engine.py:8-13`, and `scripts/python_relay.py:7-10` **Vulnerability Type**: Ineffective authorization control and misleading security documentation **Risk Level**: Medium The documentation claims that every script must be invoked through `secure_wrapper.py`, which supposedly enforces a random human-verification challenge: ```markdown ## 🛡️ Saturated Security Governance (SATURATION GATING) To resolve the 'Uneven Gating' concerns from prior audits, v2.1.0 implements **Total Lockout**: 1. **Global Gating**: EVERY script in this toolkit (including search and relay) is hard-coded to abort unless `SOTA_NUCLEAR_CONFIRMED=true` is present. 2. **Mandatory Wrapper**: All functions MUST be accessed via `secure_wrapper.py` which enforces a random numeric challenge for Human-in-the-loop verification. 3. **Autonomous Invocation Blocked**: AI Agents are physically unable to run any part of this toolkit without human interaction. ``` However, `secure_wrapper.py` is absent from the supplied project, and the actual authorization check in `scripts/main_engine.py` only tests a caller-controlled environment variable: ```python # v2.1.0 SOTA Fortress: Mandatory Global Security Gate def check_gate(): if os.environ.get('SOTA_NUCLEAR_CONFIRMED') != 'true': print("!!! [SECURITY ABORT] Unauthorized autonomous execution blocked.") print("!!! This toolkit requires manual human gating via 'secure_wrapper.py'.") sys.exit(1) ``` The same ineffective gate appears at module scope in `scripts/python_relay.py`: ```python # v2.1.0 SOTA Fortress: HARDENED GLOBAL GATE if os.environ.get('SOTA_NUCLEAR_CONFIRMED') != 'true': print("!!! [SECURITY ABORT] RELAY BLOCKED. Use secure_wrapper.py.") sys.exit(1) ``` ### Technical Analysis Environment variables supplied by the invoking process are not an authentication mechanism. Any local process or automated agent capable of launc ...[truncated 2701 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Implement the documented `secure_wrapper.py` or remove all claims that human verification is enforced. 2. Do not treat a caller-controlled environment variable as proof of authorization. 3. If human approval is required, have the wrapper issue a cryptographically random, short-lived, single-use authorization token after an interactive challenge. 4. Bind the authorization token to the exact script, requested operation, parameters, user identity, and expiration time. 5. Validate the token independently in every executable entry point. Store signing or verification material outside caller-controlled project data and environment variables. 6. Prevent direct invocation from silently becoming authorized merely because an environment variable is present. Fail closed when authorization validation cannot be completed. 7. For the relay, make local and remote ports explicit, validated configuration rather than fixed assumptions. Restrict allowed destinations and verify that the destination is the intended service. 8. Add client authentication if the relay can expose a privileged local interface. Continue binding to loopback unless broader exposure is explicitly required. 9. Log authorization events and relay startup without recording secrets or reusable tokens. 10. Add automated tests confirming that direct invocation, forged environment variables, expired tokens, reused tokens, and noninteractive invocations are rejected. 11. Reconcile `SKILL.md` with the actual package contents and remove references to absent security components and scripts until they are supplied and audited. ]]>