T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/sha1.py:3
- Finding
- Collision-Broken SHA-1 Advertised for File Integrity Verification## Vulnerability Details **File Location**: `scripts/sha1.py:3-5`; `SKILL.md:2-3, 7` **Vulnerability Type**: Use of a collision-broken cryptographic hash for security-sensitive integrity verification **Risk Level**: Medium ### Vulnerable Code `scripts/sha1.py:3-5`: ```python h = hashlib.sha1() h.update(open(sys.argv[1] if len(sys.argv) > 1 else "a.txt", "rb").read()) print(h.hexdigest()) ``` `SKILL.md:2-3`: ```yaml name: sha1-tool description: Compute SHA-1 160-bit cryptographic hash values. Use for file integrity checking and data fingerprinting. ``` `SKILL.md:7`: ```markdown Generate SHA-1 hash values for files or piped input. Produces a 160-bit (40 character hexadecimal) hash used for data integrity verification. ``` ### Technical Analysis The script explicitly uses `hashlib.sha1()` while the skill documentation recommends the resulting digest for file integrity verification. SHA-1 no longer provides adequate collision resistance: it is feasible to construct different inputs that produce the same SHA-1 digest. Consequently, equality of SHA-1 digests does not reliably prove that adversarial content is identical to previously approved content. This issue is relevant when the tool is used to establish or verify trust in files that an attacker can influence. It does not imply that an attacker can generally derive arbitrary preimages or silently modify every existing file while preserving its digest. Exploitation requires an applicable collision construction, such as preparing two related files in advance. ### Attack Path 1. An attacker prepares two distinct files using a practical SHA-1 collision or chosen-prefix collision technique: one benign file and one malicious file. 2. The benign version is submitted to a workflow that computes and approves its SHA-1 digest using this skill. 3. After approval, the attacker substitutes the malicious colliding version. 4. The workflow recomputes the SHA-1 dige ...[truncated 643 chars]
- Remediation
- ## Remediation Suggestions 1. Replace SHA-1 with a collision-resistant algorithm such as SHA-256 or SHA-512: ```python h = hashlib.sha256() ``` 2. Update `SKILL.md` to identify the selected algorithm accurately and remove recommendations to use SHA-1 for security-sensitive integrity verification. 3. If legacy SHA-1 output must remain available for compatibility, require an explicit legacy option and display a warning that SHA-1 must not be used to make trust or integrity decisions. 4. For authenticity against an active attacker, use a keyed MAC such as HMAC-SHA-256 or a digital-signature system rather than relying solely on an unkeyed digest. 5. Add tests that verify the expected algorithm and digest length so a future change cannot silently restore SHA-1.