T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:107- Finding
Unsandboxed Execution of LLM-Generated Code and Tests
- Content
View full analysis
str: code = llm(f"Write Python code for: {spec}") tests = llm(f"Generate pytest tests for: {spec}\nCode: {code}") for _ in range(max_iterations): result = run_tests(code, tests) if result["success"]: return code code = llm(f"Fix error: {result['error']}\nCode: {code}") return code ``` ### Technical Analysis The documented workflow generates both application code and test code through an LLM and passes them directly to `run_tests`. The `spec` value may contain attacker-controlled content, while LLM output must itself be treated as untrusted. No sandbox, isolation boundary, permission restriction, execution timeout, filesystem policy, network restriction, or validation stage is specified before execution. Generated tests are equally dangerous because test frameworks execute test files as ordinary code. A malicious specification or successful prompt-injection payload could induce the model to emit Python that invokes operating-system commands, reads environment variables, accesses local files, modifies the workspace, opens network connections, or consumes excessive resources. This file is documentation rather than an executable implementation. The vulnerability becomes directly exploitable when an implementation adopts the presented pattern and `run_tests` executes generated content in the host environment. ### Attack Path 1. An attacker supplies or influences the `spec` passed to `reflect_and_fix`. 2. The specification includes instructions designed to make the LLM generate malicious application code or tests. 3. The LLM returns code containing a payload, such as filesystem acce ...[truncated 1268 chars]- Remediation
View remediation