T09 · Insecure Skill Coding Practices
Error
- Location
scripts/dca.sh:172- Finding
Arbitrary Python Code Execution Through Unsanitized DCA Plan Arguments
- Content
View full analysis
Vulnerability Details
File Location:
scripts/dca.sh:172-209
Vulnerability Type: Python source-code injection
Risk Level: HighVulnerable Code
bash action_plan() { local amount="${1:-50}" frequency="${2:-7}" periods="${3:-12}" symbol="${4:-BTCUSDT}" symbol=$(echo "$symbol" | tr '[:lower:]' '[:upper:]') # Get current price local price_resp price price_resp=$(api_public "/api/v3/ticker/price" "symbol=${symbol}") price=$(echo "$price_resp" | grep -o '"price":"[^"]*"' | head -1 | cut -d'"' -f4) echo "DCA Plan: ${symbol}" echo "==========================" echo "Buy amount: \$${amount} per buy" echo "Frequency: every ${frequency} days" echo "Duration: ${periods} buys" echo "Current: ${price}" echo "==========================" python3 -c " amount = float('${amount}') periods = int('${periods}') freq = int('${frequency}') price = float('${price}') total_invested = amount * periods btc_at_current = total_invested / price total_days = freq * periods print(f'Total invest: \${total_invested:,.2f}') print(f'At cur. price: {btc_at_current:.8f} ${symbol%%USDT*}') print(f'Time span: {total_days} days (~{total_days/30:.1f} months)') print() print('Scenario Analysis (if avg price over period is):') for pct in [-30, -20, -10, 0, 10, 20, 50, 100]: avg = price * (1 + pct/100) coins = total_invested / avg value = coins * price * (1 + pct/100) pnl = value - total_invested pnl_pct = (pnl / total_invested) * 100 sign = '+' if pnl >= 0 else '' print(f' {pct:+4d}% -> avg \${avg:>10,.2f} -> {coins:.8f} BTC -> PnL: {sign}\${pnl:>10,.2f} ({sign}{pnl_pct:.1f}%)') " 2>/dev/null || die "Python3 required for plan calculations" }Technical Analysis
The
amount,frequency, andperiodscommand-line arguments are interpolated directly into a string passed topython3 -c. Theplanaction does n ...[truncated 2643 chars]- Remediation
View remediation
Remediation Suggestions
Do not construct Python source code using command-line values. Pass data as positional arguments to a fixed Python program and parse it through
sys.argv.A safer pattern is:
bash [[ "$amount" =~ ^[0-9]+([.][0-9]+)?$ ]] || die "Amount must be a positive number" [[ "$frequency" =~ ^[1-9][0-9]*$ ]] || die "Frequency must be a positive integer" [[ "$periods" =~ ^[1-9][0-9]*$ ]] || die "Number of buys must be a positive integer" [[ "$symbol" =~ ^[A-Z0-9]{2,20}$ ]] || die "Invalid trading symbol" python3 - "$amount" "$frequency" "$periods" "$price" "$symbol" <<'PY' import sys amount = float(sys.argv[1]) frequency = int(sys.argv[2]) periods = int(sys.argv[3]) price = float(sys.argv[4]) symbol = sys.argv[5] # Perform calculations using parsed values. PYApply both syntactic validation and business limits. Recommended controls include:
- Require
amountto be a finite positive decimal and impose a reasonable maximum. - Require
frequencyandperiodsto be positive integers with upper bounds. - Restrict trading symbols to expected uppercase ASCII letters and digits.
- Validate the API-provided price as a finite positive decimal before calculation.
- Keep executable Python code static; never interpolate shell variables into Python source.
- Run the Skill under a dedicated, unprivileged account.
- Provide the Binance key only to processes that require it.
- Configure the Binance key without withdrawal privileges, with only required spot-trading permissions and an IP allowlist.
- Add regression tests containing quotes, semicolons, comment characters, newlines, and Python expressions in every CLI argument.
- Require