T09 · Insecure Skill Coding Practices
- Location
SKILL.md:38- Finding
Unsafe Execution of an Untrusted Rollup Configuration During Validation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 38–40
Vulnerability Type: Arbitrary code execution through unsafe configuration loading
Risk Level: Highbash # Extract config as JSON from rollup.config.js node -e "const c = require('./rollup.config.js'); console.log(JSON.stringify(c, null, 2))" > rollup.config.json python3 scripts/rollup_config_validator.py validate rollup.config.jsonTechnical Analysis
The documented conversion command loads
rollup.config.jswith Node.jsrequire(). Loading a JavaScript configuration this way executes its top-level code before the exported object is serialized or inspected.A Rollup configuration obtained from an untrusted or compromised repository can contain arbitrary JavaScript unrelated to build configuration. Because the command provides no sandbox, privilege reduction, filesystem isolation, network restriction, or warning that the configuration must already be trusted, such code runs with the invoking user's permissions. This undermines the validator's otherwise read-only static-analysis purpose.
Attack Path
- An attacker commits or supplies a malicious
rollup.config.js. - The victim obtains the project and follows the extraction procedure documented in
SKILL.md. - The victim runs the provided
node -ecommand from the project directory. - Node resolves and loads
./rollup.config.jsthroughrequire(). - Malicious top-level statements execute before
JSON.stringify()processes the exported configuration. - The payload performs actions available to the victim's account; it may then export an ordinary-looking object to conceal the compromise.
Impact Assessment
Successful exploitation provides arbitrary code execution with the privileges of the user running the documented command. Depending on that user's access and environment, an attacker could read credentials and source files, modify or delete files, access network r ...[truncated 270 chars]
- An attacker commits or supplies a malicious
- Remediation
View remediation
Remediation Suggestions
- Remove the
require('./rollup.config.js')extraction procedure from the primary workflow because it executes the file being audited. - Use a non-executing JavaScript or TypeScript parser to extract and inspect statically declared configuration data. Reject constructs that cannot be resolved safely rather than evaluating them.
- If evaluation is unavoidable, state explicitly that it must only be used for trusted configuration files.
- Run unavoidable evaluation in a disposable sandbox or container with:
- No mounted credentials or secrets.
- Network access disabled.
- A read-only project mount.
- A separate writable temporary directory.
- A non-privileged user.
- Strict CPU, memory, process, and execution-time limits.
- Keep validation separate from configuration execution and ensure the default audit path accepts only inert JSON input.
- Add a prominent warning explaining that Node.js configuration imports execute arbitrary top-level code.
- Remove the