T09 · Insecure Skill Coding Practices
- Location
SKILL.md:24- Finding
Unverified Workspace Script Execution with PowerShell Policy Bypass
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 24-30
Vulnerability Type: Execution of an unverified workspace script
Risk Level: MediumVulnerable Code
powershell powershell -ExecutionPolicy Bypass -File "<workspace>\restart-qclaw.ps1"The surrounding instructions specify that the script is created only if it does not already exist. Consequently, an existing
restart-qclaw.ps1is executed without validating its origin, contents, ownership, or integrity.Technical Analysis
The workspace is treated as a trusted code source even though workspace files may be writable or replaceable by other users, processes, downloaded project content, or previously invoked tools. If an attacker places or modifies
restart-qclaw.ps1, the Skill will execute that content when an approved restart is performed.The use of
-ExecutionPolicy Bypassremoves a PowerShell policy safeguard that might otherwise warn about or block certain scripts. It does not itself grant administrative privileges or bypass operating-system access controls, but it increases the reliability of executing attacker-controlled PowerShell content.User confirmation mitigates accidental execution but does not address script integrity because the user is asked to approve a QClaw restart, not arbitrary commands contained in the workspace script.
Attack Path
- An attacker or compromised process obtains write access to the configured workspace.
- The attacker creates or replaces
restart-qclaw.ps1with malicious PowerShell commands. - A QClaw restart is requested after a configuration change or through ordinary user interaction.
- The user confirms the apparently legitimate restart request.
- Because the script already exists, the Skill does not regenerate it from the documented trusted template.
- PowerShell executes the attacker-controlled script with execution policy bypassed.
- The payload runs with the permis ...[truncated 715 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not execute an existing workspace script merely because it has the expected filename.
- Generate the restart script from fixed, trusted content immediately before each execution, using an atomic write operation.
- Alternatively, store the script in a protected application directory and verify its cryptographic hash or digital signature before execution.
- Refuse execution if the script is a symbolic link, reparse point, or file owned or writable by an unexpected principal.
- Avoid
-ExecutionPolicy Bypass. Use an appropriately signed script and a restrictive execution policy where operationally possible. - Keep the user confirmation requirement, but disclose the exact validated script path and integrity status before execution.
- Apply least-privilege permissions to the script and its parent directory, and execute the restart without administrative elevation unless explicitly required.
- Record integrity-check failures and abort rather than falling back to unverified workspace content.