T09 · Insecure Skill Coding Practices
Error
- Location
scripts/team-builder.sh:780- Finding
Python Code Injection Through Unvalidated Agent Identifiers
- Content
View full analysis
/dev/null) fi local subordinates="" if [ -f "$HIERARCHY_FILE" ]; then subordinates=$(python3 -c " import json h=json.load(open('$HIERARCHY_FILE')) a=h.get('agents',{}).get('$aid',{}) manages=a.get('manages',[]) for m in manages: mi=h['agents'].get(m,{}) print(f\"- {mi.get('emoji','🤖')} {mi.get('name',m)} ({m})\") " 2>/dev/null) fi ``` Additional instances of the same pattern include: ```bash agent_filter = '$agent_filter' ``` and: ```bash python3 -c " import json with open('$CONFIG_FILE') as f: c = json.load(f) a2a = c.get('tools', {}).get('agentToAgent', {}) allow = a2a.get('allow', []) for a in c.get('agents', {}).get('list', []): if a['id'] not in allow and a['id'] != 'main': allow.append(a['id']) if '$aid' not in allow: allow.append('$aid') ``` ### Technical Analysis Values originating from the `--id`, `--parent`, and `--agent` command-line parameters are expanded directly into Python source passed to `python3 -c`. These values are placed inside Python string literals without escaping. The documentation describes agent IDs as kebab-case, but the script does not enforce that restriction before the values reach the embedded Python programs. A value containing a single quote can terminate the intended Python string. The remaining content can then introduce additional P ...[truncated 2011 chars]- Remediation
View remediation