T09 · Insecure Skill Coding Practices
- Location
scripts/get_transcript.sh:81- Finding
Arbitrary Python Code Execution Through Unsafe Timestamps Argument Interpolation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/get_transcript.sh, lines 81-86
Vulnerability Type: Python code injection
Risk Level: HighVulnerable Code
bash # Clean VTT/SRT to plain text python3 -c " import re, sys timestamps_mode = '$TIMESTAMPS' == 'timestamps' with open('$SUBTITLE_FILE', 'r', encoding='utf-8') as f:Technical Analysis
The fourth command-line argument is assigned to
TIMESTAMPSand then interpolated directly into source code passed topython3 -c. Although the shell variable appears between single quotation marks in the generated Python statement, those quotation marks are part of the Python source rather than a shell-level security boundary.An attacker can include a single quote and Python statement delimiters in the fourth argument. This closes the intended Python string literal and inserts arbitrary Python statements. The remainder of the original statement can then be neutralized with a Python comment.
For example, a fourth argument shaped like the following would cause an observable file write:
text '; __import__("pathlib").Path("/tmp/transcript-injection-poc").write_text("executed"); #This produces Python source equivalent to:
python timestamps_mode = ''; __import__("pathlib").Path("/tmp/transcript-injection-poc").write_text("executed"); #' == 'timestamps'The same primitive can invoke
os.system,subprocess, or native Python APIs to execute commands and access files. The vulnerability does not require shell metacharacters to survive shell evaluation because the malicious value is introduced through normal argument expansion into the Python program.The subtitle path is also embedded into Python source using the same unsafe pattern. Although the reviewed script normally derives that path from a private temporary directory and a fixed
yt-dlpoutput template, it should still be passed as data rather than interpolated into sourc ...[truncated 1906 chars]- Remediation
View remediation
Remediation Suggestions
Never construct executable Python source by interpolating command-line arguments. Pass all dynamic values through
sys.argvor environment variables and validate options before invoking Python.A safer implementation is:
bash case "$TIMESTAMPS" in ""|timestamps) ;; *) echo "ERROR: Fourth argument must be 'timestamps' or empty." >&2 exit 2 ;; esac python3 - "$TIMESTAMPS" "$SUBTITLE_FILE" > "$OUTPUT" <<'PY' import re import sys timestamps_mode = sys.argv[1] == "timestamps" subtitle_file = sys.argv[2] with open(subtitle_file, "r", encoding="utf-8") as f: content = f.read() # Continue transcript processing here. PYThis hardening separates code from data, prevents quotation characters in arguments from changing Python syntax, and safely handles unusual subtitle paths. Additional input validation should restrict the timestamps mode to the documented values and reject unexpected extra options.