T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/ldr-research.sh:24
- Finding
- Arbitrary Shell Execution Through Sourced Environment File<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ldr-research.sh`, lines 24–30 **Vulnerability Type**: Unsafe execution of a configuration file **Risk Level**: High ### Vulnerable Code ```bash LDR_ENV="${LDR_CONFIG_DIR:-$HOME/.config/local_deep_research/config}/.env" if [[ -f "$LDR_ENV" ]]; then set -a # shellcheck source=/dev/null source "$LDR_ENV" set +a fi ``` ### Technical Analysis The script loads the selected `.env` file with Bash's `source` command. This does not treat the file as passive key-value configuration: it parses and executes its entire contents as shell code. The location is also influenced by the `LDR_CONFIG_DIR` environment variable. Therefore, an attacker who can modify the default `.env`, control `LDR_CONFIG_DIR`, or place a malicious file in a selected directory can execute arbitrary shell commands when any Skill action starts. For example, a purported `.env` file could contain command substitutions, shell functions, redirections, or direct commands in addition to variable assignments. Those statements would run with the permissions and environment of the process invoking the Skill. This exceeds the minimum privilege required by the declared functionality. The script only needs a small, documented set of LDR configuration values and does not need to execute general shell instructions from a credential file. ### Attack Path 1. An attacker obtains write access to `~/.config/local_deep_research/config/.env`, influences the inherited `LDR_CONFIG_DIR`, or causes it to reference an attacker-controlled directory. 2. The attacker places shell commands in the selected `.env` file. 3. The user or Agent invokes any action in `scripts/ldr-research.sh`. 4. Startup processing reaches `source "$LDR_ENV"`. 5. Bash executes the attacker-controlled commands before the requested research action begins. 6. The commands operate with the same filesystem, process, environment, and network permissions as the invoking Agent ...[truncated 814 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not use `source`, `.`, or `eval` to load `.env` files. 2. Prefer supplying credentials directly through the process environment or a dedicated secret manager. 3. If file-based configuration is required, implement a non-executing parser that: - Accepts only an explicit allowlist of supported keys. - Treats values as data rather than shell syntax. - Rejects command substitutions, function definitions, redirections, and malformed lines. - Validates each value according to its expected type and format. 4. Restrict accepted keys to documented variables such as `LDR_BASE_URL`, `LDR_SERVICE_USER`, `LDR_SERVICE_PASSWORD`, and supported default settings. 5. Before reading the file, verify that it: - Is a regular file rather than a symbolic link. - Is owned by the expected user. - Is not group- or world-writable. - Has restrictive permissions, preferably mode `0600`. 6. Avoid allowing an untrusted inherited `LDR_CONFIG_DIR` to select arbitrary files. If configurability is necessary, validate or explicitly approve the path. 7. Run the Skill in a constrained environment with only the filesystem and network access required to contact the LDR service. ]]>