T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:68
- Finding
- Untrusted Project Plans Can Direct Arbitrary Deployment Command Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:68` **Vulnerability Type**: Trusting repository-controlled deployment instructions without validation **Risk Level**: High ### Vulnerable Code Snippet ```markdown **Plan-driven deploy:** If the active plan contains deploy phases or tasks (e.g. "deploy Python backend to VPS", "run deploy.sh", "set up Docker on server"), treat those as **primary deploy instructions**. The plan knows the project-specific deploy targets that the generic stack YAML may not cover. Execute plan deploy tasks in addition to (or instead of) the standard platform deploy below. ``` ### Technical Analysis The skill instructs the agent to treat project-controlled plan documents as primary deployment instructions and execute their tasks. The project repository is an untrusted input boundary: an attacker who can contribute repository content can place malicious commands or references to malicious scripts in `docs/plan/*/plan.md`. No command allowlist, script inspection requirement, trust validation, or explicit user-confirmation gate is imposed before plan-derived instructions are executed. Because the skill permits Bash and deployment tools, a crafted plan could direct the agent to run a repository script, access a remote server, alter deployment infrastructure, or invoke commands unrelated to the legitimate deployment. ### Attack Path 1. An attacker adds or modifies an active `docs/plan/*/plan.md`. 2. The plan presents a malicious command or script as a required deployment task, such as running a modified `deploy.sh`. 3. The skill loads the plan and treats its tasks as primary deployment instructions. 4. The agent executes the referenced command or script through Bash. 5. The command runs with the permissions and environment of the agent process, potentially including authenticated repository and cloud CLI sessions. ### Impact Assessment Successful exploitation could execute commands with the local privileges of the ag ...[truncated 605 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat all repository documentation and deployment plans as untrusted input. 2. Parse plan files as descriptive context rather than executable authority. 3. Restrict plan-derived actions to a documented allowlist of deployment operations. 4. Require explicit user confirmation before executing any command originating from a plan file. 5. Display the exact command, target host, affected environment, and expected side effects before execution. 6. Inspect referenced scripts in full and reject scripts containing unrelated network access, credential access, destructive commands, privilege escalation, or persistence behavior. 7. Run approved scripts in a sandbox with minimal filesystem access, restricted network access, and narrowly scoped credentials. 8. Prefer known deployment commands derived from reviewed stack configuration over free-form commands embedded in project documents. ]]>