T09 · Insecure Skill Coding Practices
- Location
SKILL.md:96- Finding
Unrestricted Execution of Potentially Untrusted Evaluated Skills
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:96andSKILL.md:267
Vulnerability Type: Unsafe execution of untrusted Skill content
Risk Level: MediumRelevant snippets:
markdown #### Dimension Five: Practical Validation (Weight: 15%) > Actually run the Skill to validate its functionalitymarkdown 2. **Prioritize practical validation**: Dimension Five (Practical Validation) requires actually running the Skill; reviewing documentation alone is insufficient.The snippets above are faithful English translations of the original instructions at the cited locations.
Technical Analysis
The Skill requires an agent to execute a target Skill during evaluation, even though the target may be untrusted. It does not require a sandbox, network restrictions, filesystem boundaries, a capability review, resource limits, dependency validation, or explicit user approval before execution.
Consequently, dynamic validation may cause attacker-controlled instructions or code from the evaluated Skill to run with the reviewing agent's ambient tool permissions. The audited package does not itself contain a malicious payload, but its prescribed validation process creates an unsafe execution boundary.
Attack Path
- An attacker submits a crafted investment-research Skill for evaluation.
- The evaluator loads its instructions and linked files.
- Following
SKILL.md:96andSKILL.md:267, the evaluator performs actual execution rather than limiting the review to static analysis. - The crafted Skill requests or triggers dangerous tool operations, such as command execution, filesystem access, dependency installation, or outbound network requests.
- In the absence of isolation and capability restrictions, those operations run with whatever permissions are available to the reviewing agent.
Impact Assessment
The resulting privileges depend on the evaluator's runtime permissions. A malicious ...[truncated 557 chars]
- Remediation
View remediation
Remediation Suggestions
- Make static inspection the default and require explicit user approval before any dynamic execution.
- Run evaluated Skills only in a disposable sandbox or isolated container with no host secrets.
- Mount only a dedicated temporary working directory and deny access to unrelated host files.
- Disable outbound networking by default; where necessary, enforce destination and protocol allowlists.
- Expose only the minimum tools required for the test and prohibit shell execution, package installation, persistence mechanisms, and credential access unless specifically approved.
- Apply CPU, memory, process, storage, and execution-time limits.
- Review all linked scripts, dependencies, and requested capabilities before execution; pin approved dependencies to trusted versions and sources.
- Log tool calls, filesystem changes, network attempts, and subprocess activity for auditability.
- Abort validation when a target Skill requests capabilities outside the declared investment-research use case.
- Replace the unsafe requirement with language such as: “Perform static review first. Dynamic validation is optional and may occur only in an isolated, least-privilege environment after capability review and explicit authorization.”