T09 · Insecure Skill Coding Practices
- Location
SKILL.md:13- Finding
Execution of Untrusted Vite Configuration During JSON Export
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:13andSKILL.md:116
Vulnerability Type: Arbitrary code execution through dynamic import of an untrusted configuration
Risk Level: HighThe documentation instructs users to import and execute a Vite configuration to produce the JSON input consumed by the validator:
bash node -e "import('./vite.config.ts').then(m => console.log(JSON.stringify(m.default)))" > vite.config.jsonThe same command is recommended for CI integration:
yaml - name: Validate Vite config run: | node -e "import('./vite.config.ts').then(m => console.log(JSON.stringify(m.default)))" > /tmp/vite.config.json python3 scripts/vite_config_validator.py validate /tmp/vite.config.json --strict --format jsonTechnical Analysis
A JavaScript dynamic
import()does not parse a configuration as passive data. It loads and evaluates the module, including all top-level statements and imported dependencies, with the privileges of the invoking Node.js process.The Skill is presented as a tool for auditing Vite projects and reviewing changes to
vite.config.ts. If the audited repository or proposed change is untrusted, an attacker can place arbitrary JavaScript in the configuration or one of its imported modules. That code executes beforeJSON.stringify(m.default)is reached. The Python validator itself only reads JSON and does not execute it, but the documented preprocessing procedure creates an unsafe code-execution boundary.No sandboxing, trust warning, network restriction, filesystem isolation, or privilege reduction is specified. In CI, the imported configuration may consequently run with access to repository contents, writable build workspaces, job tokens, environment variables, and any secrets exposed to the job.
Attack Path
- An attacker supplies a repository, pull request, or configuration change containing malicious top-level code in `vite.config.t ...[truncated 1226 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not dynamically import configuration files from untrusted repositories on a developer workstation or privileged CI runner.
- Prefer static parsing of supported Vite configuration syntax. Extract object-literal values without evaluating JavaScript, and explicitly report constructs that cannot be analyzed statically.
- If evaluation is unavoidable, run it in a disposable, hardened sandbox or container configured with:
- A non-root user and no additional Linux capabilities.
- No mounted host credentials, agent sockets, package-manager tokens, or cloud metadata access.
- A read-only source mount and a separate, minimally scoped output directory.
- No network access unless strictly required.
- A clean environment without CI or deployment secrets.
- CPU, memory, process, and execution-time limits.
- A disposable filesystem destroyed after evaluation.
- Separate validation of untrusted pull requests from trusted release jobs. Do not expose secrets to jobs that evaluate contributor-controlled configuration.
- Add a prominent warning immediately before every export example stating that importing
vite.config.tsexecutes arbitrary project code and is safe only for trusted repositories. - Consider requiring users to generate the JSON snapshot in an already trusted development environment and validate only the resulting inert JSON in security-sensitive workflows.