T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:46- Finding
User-Controlled Python Code Injection in Persona Creation Workflow
- Content
View full analysis
', 'relation': '', 'personality': '', 'tone_of_voice': '', }, 'appearance': { 'description': '', 'reference_image_path': './assets/personas/persona_ref.png', }, } with open('data/persona.json', 'w', encoding='utf-8') as f: json.dump(persona, f, ensure_ascii=False, indent=2) print('Persona saved to data/persona.json') " ``` ### Technical Analysis The documented onboarding workflow instructs the agent to insert user-provided values directly into quoted Python source code passed to `python -c`. The fields `name`, `relation`, `personality`, `toneOfVoice`, and `appearance` are not encoded or escaped as Python string literals. A malicious value containing a quote and valid Python syntax can terminate the intended string literal and inject an expression or statement into the generated program. Shell metacharacters may introduce an additional parsing risk because the complete program is also enclosed in a shell double-quoted argument, but Python-level injection alone is sufficient to make the workflow unsafe. This vulnerability arises from generating executable source code using untrusted data rather than passing user values through a structured data channel. ### Attack Path 1. The onboarding workflow asks a user for persona information. 2. An attacker supplies a persona field containing a closing quote followed by malicious Python syntax. 3. The agent substitutes that value into the documented `python -c` command. 4. The command is executed to create `data/persona.json`. 5. The injected Python executes with the same operating-system pri ...[truncated 782 chars]- Remediation
View remediation