T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:735
- Finding
- Unsafe Configuration Interpolation Enables Python and SQL Injection## Vulnerability Details **File Location**: `SKILL.md`, lines 641-650, 735-742, and 800-805 **Vulnerability Type**: Configuration-driven code injection **Risk Level**: High ### Vulnerable Code ```sql CREATE EXTERNAL STREAM IF NOT EXISTS {{ .DB }}.raw_feed (msg string) SETTINGS type='websocket', url='{{ .Config.websocket_url }}'; ``` ```sql CREATE OR REPLACE FUNCTION notify_slack(channel string, message string) RETURNS bool LANGUAGE PYTHON AS $$ import requests def notify_slack(channel, message): url = '{{ .Config.slack_webhook_url }}' requests.post(url, json={'channel': channel, 'text': message}) return [True] * len(channel) $$; ``` ```sql CREATE ALERT IF NOT EXISTS {{ .DB }}.price_spike_alert BATCH 10 EVENTS WITH TIMEOUT 5s LIMIT 1 ALERTS PER 10s CALL {{ .DB }}.notify_slack AS SELECT product_id, price, _tp_time FROM {{ .DB }}.coinbase_tickers WHERE price > {{ .Config.alert_threshold }}; ``` ### Technical Analysis The Skill recommends directly inserting install-time configuration values into SQL string literals, executable Python source, and unquoted SQL expressions. No context-specific escaping, validation, or strict allowlisting is applied. The most severe case is `slack_webhook_url`. Because it is placed directly inside a single-quoted Python literal, a value containing a quote and additional Python syntax can terminate the intended string and modify the generated UDF body. The generated code is subsequently registered and executed by the Timeplus server. The `websocket_url` value is similarly inserted into a SQL literal without SQL-literal escaping. A malicious value could terminate the literal and alter the generated DDL if the surrounding parser permits the resulting syntax. The unquoted `alert_threshold` expression can also change the alert predicate or inject additional SQL expression syntax unless the manifest strictly enforces an integer or float type b ...[truncated 1229 chars]
- Remediation
- ## Remediation Suggestions - Do not construct executable Python source from raw configuration values. - Pass webhook URLs and credentials through runtime parameters or a protected secret reference rather than embedding them in a UDF body. - Apply context-specific SQL literal escaping for values inserted into SQL strings. - Declare numeric values such as `alert_threshold` with strict numeric types and reject values that do not match a canonical numeric representation. - Validate URLs using an allowlist of approved schemes and, where possible, approved destination hosts. - Reject control characters, unexpected quotes, template delimiters, and multiline input where they are not necessary. - Generate structured resource definitions through safe APIs rather than string concatenation whenever supported. - Execute generated UDFs in a restricted sandbox without filesystem access, unrestricted network access, or unnecessary service credentials. - Add tests using quote characters, backslashes, newlines, and code fragments to verify that configuration values cannot change generated syntax.