T09 · Insecure Skill Coding Practices
Error
- Location
- index-local.js:571
- Finding
- Arbitrary JavaScript Execution Through Unsafe Frontmatter Parsing<![CDATA[ ## Vulnerability Details **File Location**: `index-local.js:571-583` **Vulnerability Type**: Unsafe evaluation of file-controlled data **Risk Level**: High ### Vulnerable Code ```js const tagsMatch = fm.match(/^tags:\s*\[([\s\S]*?)\]/m); if (titleMatch) entryData.title = titleMatch[1]; if (domainMatch) entryData.domain = domainMatch[1]; if (confidenceMatch) entryData.confidence = confidenceMatch[1]; if (impactMatch) entryData.impact = impactMatch[1]; if (tagsMatch) { try { const tagsArray = eval(`[${tagsMatch[1]}]`); // Safe since we control the format entryData.tags = tagsArray.join(', '); } catch (e) { entryData.tags = tagsMatch[1]; } } ``` ### Technical Analysis The `generateIndex` function scans every Markdown file in each configured content-type directory and extracts the contents of the `tags` frontmatter field. It then passes the extracted text directly to JavaScript `eval`. The claim that the input format is controlled is incorrect because these directories can contain manually created, imported, synchronized, or otherwise attacker-influenced Markdown files. The cleanup implementation explicitly recognizes that files can exist without being tracked by the Skill's state. A tags field can contain a valid JavaScript expression rather than a simple string list. For example, an expression using an immediately invoked function can execute before returning a value acceptable to the surrounding array. Execution occurs in the Node.js process and can access Node globals and modules available to the application. ### Attack Path 1. An attacker gains the ability to place or modify a Markdown file in an output content directory such as `Research/`, `Decision/`, or `Insight/`. 2. The attacker creates frontmatter containing a malicious JavaScript expression in the `tags` array. 3. A user or scheduled workflow runs `km summarize`. 4. `generateIndex` reads the malicious file and captures the tags content. 5. The captured content is p ...[truncated 819 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `eval` entirely. Structured data must never be interpreted as JavaScript. 2. Parse frontmatter using a maintained YAML parser configured with a safe schema that does not instantiate arbitrary types or functions. 3. If an additional dependency is undesirable, implement strict parsing that only accepts a comma-separated list of quoted strings. 4. Validate that the parsed value is an array and that every element is a string with an enforced maximum length. 5. Reject malformed tags instead of attempting to evaluate or loosely interpret them. 6. Escape Markdown table metacharacters before inserting frontmatter values into generated indexes. 7. Add security tests using malicious tags expressions to verify that summarization cannot cause code execution. ]]>