T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/send-email.sh:8
- Finding
- Arbitrary Shell Command Execution Through Unsafe .env Loading## Vulnerability Details **File Location**: `scripts/send-email.sh`, lines 8–12 **Vulnerability Type**: Unsafe execution of configuration data **Risk Level**: Medium ```bash if [ -f "${ROOT_DIR}/.env" ]; then set -a # shellcheck disable=SC1091 . "${ROOT_DIR}/.env" set +a fi ``` ### Technical Analysis The script loads the project-root `.env` file with the shell dot command (`.`). Dot-sourcing does not treat the file as passive configuration: it parses and executes its contents as shell code in the current process. Consequently, an attacker who can create or modify the skill-root `.env` file can insert command substitutions, shell functions, redirections, or arbitrary commands. These commands execute whenever `scripts/send-email.sh` is invoked. Execution occurs before the script validates its argument count or checks the required environment variables, so even an otherwise invalid invocation triggers the malicious content. The repository does not contain a malicious `.env`, and no evidence of intentional malicious behavior was identified. The vulnerability depends on an attacker or another compromised process gaining write access to that external configuration file. ### Attack Path 1. An attacker gains the ability to create or modify `.env` in the project root. 2. The attacker adds shell code to the file, for example: ```bash RESEND_API_KEY=placeholder RESEND_FROM=sender@example.com arbitrary_attacker_command ``` 3. A user or agent invokes `scripts/send-email.sh`. 4. Lines 8–12 dot-source `.env`. 5. The injected command executes with the same operating-system identity and permissions as the invoking user or agent. 6. The injected code can access data available to that process, including exported secrets and readable local files, and can perform any network or filesystem operation permitted to that identity. ### Impact Assessment Successful exploitation provides arbitrary command execution under the privileges of the user or agent r ...[truncated 457 chars]
- Remediation
- ## Remediation Suggestions - Do not load `.env` with `source` or the dot command. - Replace executable loading with a parser that accepts only an explicit allowlist of keys, such as `RESEND_API_KEY` and `RESEND_FROM`. - Reject malformed lines, unknown keys, command substitutions, shell metacharacters, and unsupported quoting rather than evaluating them. - Prefer supplying secrets through a trusted process environment or secret manager instead of a repository-local file. - Verify that any local configuration file is a regular file, is owned by the expected user, is not a symbolic link, and is not writable by group or other users. - Apply restrictive permissions such as `0600` to files containing credentials. - Keep validation and JSON serialization of email fields, but ensure configuration values are never evaluated as shell syntax.