T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/firecrawl.sh:14
- Finding
- Arbitrary Shell Execution Through Sourced Environment Files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/firecrawl.sh:14-19` **Vulnerability Type**: Unsafe execution of configuration files **Risk Level**: High ### Vulnerable Code ```bash # Load .env from multiple locations for envfile in "$WORKSPACE_DIR/.env" "$SKILL_DIR/.env" .env; do if [ -f "$envfile" ]; then set -a; source "$envfile"; set +a fi done ``` ### Technical Analysis The script loads `.env` files with Bash's `source` command. A sourced file is executed as shell code rather than parsed as a collection of environment variable assignments. Consequently, a `.env` file can contain command substitutions, shell functions, redirections, pipelines, or arbitrary commands. The script checks three locations, including `.env` in the current working directory, which may belong to an untrusted project. The use of `set -a` exports variables but does not restrict what the sourced file can execute. ### Attack Path 1. An attacker supplies or modifies a project containing a malicious `.env` file. 2. The Agent enters that directory and invokes `scripts/firecrawl.sh`. 3. The loop finds the current-directory `.env`. 4. Bash executes the file through `source`. 5. Commands in the file execute with the same operating-system privileges and environment access as the Agent. For example, command substitution in an apparent assignment would execute immediately: ```bash FIRECRAWL_API_KEY="$(malicious-command)" ``` ### Impact Assessment Successful exploitation permits arbitrary command execution under the Agent's account. The attacker could read accessible credentials, modify project or workspace files, launch network requests, or tamper with generated output. The impact extends to every file and secret accessible to the process account. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions - Never load dotenv files with `source`, `.`, or `eval`. - Use a dedicated dotenv parser that treats the file strictly as data. - Load only the required `FIRECRAWL_API_KEY` variable. - Reject command substitutions, shell operators, functions, and malformed variable names. - Avoid automatically searching the current working directory for credential files. - Prefer receiving the API key through an already-populated process environment or a protected secret manager. - Ensure any credential file has restrictive filesystem permissions. ]]>