Quantum Lab Runner

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:05 AM UTC
• Version: 0.1.0

Overview

This skill is a small Quantum Lab runner, but its helper can run arbitrary local commands and install dependencies from a configurable external repo path.

Review and trust the configured quantum_lab repository and qiskit virtual environment before installing. Use this only where arbitrary local command execution is acceptable, and prefer fixed, reviewed commands plus pinned dependency files instead of allowing free-form qexec usage.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/qexec.sh:17

Finding

Unrestricted Command Execution Through the Quantum Lab Helper

Content

View full analysis

Vulnerability Details

File Location: scripts/qexec.sh, lines 17-28
Vulnerability Type: Unrestricted command execution
Risk Level: High

Vulnerable Code

bash

if [[ $# -eq 0 ]]; then
  echo "Usage: qexec <command> [args...]" >&2
  echo "Example: qexec python quantum_app.py self-tests" >&2
  exit 2
fi

# shellcheck disable=SC1090
source "$VENV/bin/activate"
cd "$ROOT"

exec "$@"

Technical Analysis

The helper is presented as a runner for approved Quantum Lab Python scripts, but it passes all supplied arguments directly to exec without validating the executable or its arguments. Consequently, it is not restricted to Python, the documented project scripts, or the documented subcommands.

The use of "$@" correctly preserves argument boundaries and prevents ordinary shell metacharacter expansion at this point. However, it does not prevent a caller from directly selecting an unrestricted executable such as a shell, network utility, file-management utility, or another locally installed program.

Attack Path

1. An attacker or untrusted user supplies a request that causes the Agent to invoke qexec.sh.
2. The request specifies an executable and arguments outside the documented Quantum Lab command set.
3. The helper activates the configured virtual environment and changes into the repository.
4. exec "$@" starts the attacker-selected executable with the Agent process's privileges.
5. The selected program can read, modify, or transmit resources available to that operating-system account.

Impact Assessment

Successful exploitation provides general command execution under the identity and permissions of the Agent process. The attacker could access files readable by that account, modify writable project or user files, invoke local network clients, or run additional programs. The script does not itself elevate to root, so the maximum scope remains bounded by ...[truncated 65 chars]

Remediation

View remediation

Remediation Suggestions

Replace unrestricted exec "$@" behavior with an explicit allowlist of supported operations. Map fixed subcommand names to fixed scripts rather than accepting arbitrary executable names.

Recommended controls include:

• Permit only the documented Python entry points and recognized subcommands.
• Invoke the virtual environment's Python interpreter by an approved canonical path.
• Reject absolute executable paths, path traversal, shell interpreters, and undocumented programs.
• Validate notebook paths after canonicalization and require them to remain inside the repository.
• Add -- where supported to prevent user-controlled values from being interpreted as options.
• Run the helper in a sandbox with minimal filesystem and network permissions.
• Log the selected approved operation without recording sensitive arguments.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/qexec.sh:4

Finding

Attacker-Selectable Activation File Is Executed as Shell Code

Content

View full analysis

Vulnerability Details

File Location: scripts/qexec.sh, lines 4-24
Vulnerability Type: Unsafe sourcing of a configurable shell file
Risk Level: High

Vulnerable Code

bash

ROOT="${QUANTUM_LAB_ROOT:-$HOME/work/quantum_lab}"
VENV="${VENV_PATH:-$HOME/.venvs/qiskit}"

if [[ ! -d "$VENV" ]]; then
  echo "Venv not found: $VENV" >&2
  echo "Set VENV_PATH or create the venv first." >&2
  exit 1
fi

if [[ ! -d "$ROOT" ]]; then
  echo "Repo not found: $ROOT" >&2
  exit 1
fi

if [[ $# -eq 0 ]]; then
  echo "Usage: qexec <command> [args...]" >&2
  echo "Example: qexec python quantum_app.py self-tests" >&2
  exit 2
fi

# shellcheck disable=SC1090
source "$VENV/bin/activate"

Technical Analysis

VENV_PATH is accepted from the process environment and used to construct the path of a file loaded with Bash's source command. Sourcing a file executes its contents in the current shell process; it is not merely a configuration-file read.

The implementation verifies only that the selected virtual-environment directory exists. It does not canonicalize the path, restrict it to an approved directory, confirm the ownership or permissions of bin/activate, or verify the file's integrity. Therefore, an attacker who can set VENV_PATH and create files at the selected location can execute arbitrary shell statements before the requested command begins.

Attack Path

1. The attacker creates a directory containing a malicious bin/activate file.
2. The attacker arranges for VENV_PATH to reference that directory, such as through a controllable Agent environment or invocation configuration.
3. The helper confirms only that the directory exists.
4. source "$VENV/bin/activate" executes the malicious file in the helper's shell.
5. The payload runs with the Agent process's permissions and can also alter environment variables or shell state before the ...[truncated 580 chars]

Remediation

View remediation

Remediation Suggestions

Avoid sourcing an activation script. Invoke the intended interpreter directly, for example through a pinned canonical path under a trusted virtual environment.

If configurability is required:

• Canonicalize the configured path with a reliable path-resolution mechanism.
• Require the resulting path to be inside an administrator-approved parent directory.
• Verify that the environment directory and activation file are owned by the expected account.
• Reject activation files or parent directories writable by untrusted users.
• Verify the activation file against an approved digest where practical.
• Clear or tightly control VENV_PATH when the helper is launched across a trust boundary.
• Prefer a fixed configuration file protected by filesystem permissions over an inherited environment variable.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:41

Finding

Dependency Installation Is Recommended From an Unverified Configurable Repository

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 41
Vulnerability Type: Unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

- If dependencies are missing: `bash <SKILL_DIR>/scripts/qexec.sh pip install -r requirements.txt`.

Related configurable repository selection in scripts/qexec.sh, line 4:

bash

ROOT="${QUANTUM_LAB_ROOT:-$HOME/work/quantum_lab}"

Technical Analysis

The skill recommends running pip install against requirements.txt from the current Quantum Lab repository. That repository is external to the audited skill package and can be redirected through QUANTUM_LAB_ROOT. The audited project does not contain the referenced requirements file, so package names, versions, hashes, indexes, source archives, and build behavior cannot be verified from this artifact.

Python dependency installation can execute package build backends or installation logic. If the configurable repository or its requirements file is replaced or compromised, following this instruction could install malicious, substituted, or unexpectedly updated packages.

Attack Path

1. An attacker compromises the configured Quantum Lab repository or prepares another repository containing a malicious requirements.txt.
2. The attacker causes QUANTUM_LAB_ROOT to select that repository, or modifies the requirements file at the normal repository path.
3. Dependencies appear to be missing, prompting use of the documented installation command.
4. qexec.sh changes into the selected repository.
5. pip install -r requirements.txt resolves and installs the attacker-selected dependencies.
6. Malicious package installation or build behavior executes with the invoking account's permissions, or malicious code remains in the virtual environment for later execution.

Impact Assessment

The immediate impact can include arbitrary code execution during package ...[truncated 312 chars]

Remediation

View remediation

Remediation Suggestions

• Maintain a reviewed, version-pinned dependency lock file under trusted source control.
• Require cryptographic hashes for downloaded artifacts, such as with pip's --require-hashes.
• Restrict package resolution to approved indexes and explicitly configured trusted repositories.
• Do not install dependencies from an arbitrary path selected by QUANTUM_LAB_ROOT.
• Review transitive dependencies and package build requirements.
• Prefer prebuilt, verified environments or immutable container images.
• Perform installation in an isolated, minimally privileged environment without unnecessary credentials or network access.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.