T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:34- Finding
Arbitrary Python Code Execution Through Unsafe File Path Interpolation
- Content
View full analysis
') for p in doc.paragraphs: print(p.text) for table in doc.tables: for row in table.rows: print('\t'.join(cell.text for cell in row.cells)) " ``` ### Technical Analysis The Skill instructs the Agent to replace a placeholder embedded directly inside Python source code with a user-provided document path. The path is placed within a raw single-quoted Python string: ```python doc = Document(r'') ``` Raw strings do not prevent quote termination. A crafted path containing a single quote can close the string literal and introduce attacker-controlled Python expressions or statements. Because the entire generated program is supplied to `python -c`, injected Python runs with the same operating-system identity, environment, working directory, file access, and network access as the Agent process. The surrounding shell command also creates an additional parsing layer. Depending on how the Agent performs substitution, shell-sensitive content in the path may produce further command-construction hazards. This issue does not independently elevate operating-system privileges. Its severity arises from converting an otherwise passive document path into executable code under the Agent's existing privileges. ### Attack Path 1. An attacker supplies a novelty-report document with a deliberately crafted filename or recommends a crafted path to the Agent. 2. The normal document-reading operation fails, returns corrupted text, or appears incomplete, causing the documented fallback procedure to be used. 3. The Agent substitutes the attacker-controlled path ...[truncated 1213 chars]- Remediation
View remediation