T09 · Insecure Skill Coding Practices
- Location
youtube_publisher.py:45- Finding
Unsafe Deserialization of the OAuth Token File Enables Arbitrary Code Execution
- Content
View full analysis
Vulnerability Details
File Location:
youtube_publisher.py, lines 45-47
Vulnerability Type: Unsafe Python pickle deserialization
Risk Level: Highpython if TOKEN_FILE.exists(): with open(TOKEN_FILE, 'rb') as token: creds = pickle.load(token)Technical Analysis
The application automatically deserializes
credentials/token.pickleusingpickle.load()whenever aYouTubePublisherinstance is initialized. Python pickle files are executable serialization streams rather than passive data formats. A crafted pickle can invoke attacker-selected Python callables during deserialization.The application performs no integrity, ownership, file-type, or permission checks before loading the file. Because
TOKEN_FILEpoints to a predictable location inside the project, any attacker who can create or replace that file can convert the next application invocation into arbitrary code execution.Attack Path
- An attacker obtains write access to the project directory, the
credentialsdirectory, or an artifact deployment process that suppliestoken.pickle. - The attacker creates a malicious pickle whose reduction operation invokes an arbitrary command or Python callable.
- The malicious file is placed at
credentials/token.pickle. - A user starts the command-line tool or initializes
YouTubePublisher. _authenticate()detects the file and callspickle.load(token).- The embedded operation executes before the returned object is validated or used as an OAuth credential.
This path requires the attacker to obtain write access to the token location; the code does not independently provide remote access to that location.
Impact Assessment
Successful exploitation provides arbitrary code execution with the privileges of the account running the Skill. The attacker could read or modify files available to that account, steal OAuth credentials, alter uploaded content, execute netw ...[truncated 150 chars]
- An attacker obtains write access to the project directory, the
- Remediation
View remediation
Remediation Suggestions
- Remove pickle-based credential storage entirely.
- Serialize credentials as non-executable JSON using
Credentials.to_json(). - Reload credentials with
Credentials.from_authorized_user_file()while specifying the expected scopes. - Validate the JSON structure and reject unexpected credential types or fields.
- Store the token outside the project directory in an operating-system-specific private application-data directory or credential manager.
- Before reading a filesystem token, reject symbolic links and verify that the file is a regular file owned by the expected user.
- Apply owner-only permissions to both the credential directory and token file.
- If integrity against local replacement is required, protect the token through an operating-system credential service rather than relying only on file permissions.