T09 · Insecure Skill Coding Practices
Error
- Location
audit_transcript.py:109- Finding
High-Risk Commands Can Be Misclassified as Whitelisted
- Content
View full analysis
目录查看，安全 Get-Content -> 读取文件内容，安全 type -> 读取文件内容，安全 cat -> 读取文件内容，安全 dir -> Windows目录查看 # Unix 目录查看 ls -> 目录列表，安全 # 文件查看 type -> 查看文件内容，安全 cat -> 查看文件内容，安全 ``` ### Technical Analysis Whitelist patterns are passed directly to `re.search()` and are therefore treated as unanchored regular expressions. Generic patterns such as `cat`, `ls`, `dir`, and `type` can match anywhere inside a command rather than matching only an intended executable and safe argument structure. The script calculates the command's risk level before checking the whitelist, but the final classification gives the whitelist absolute precedence. Consequently, a command that matches both a HIGH-risk rule and any whitelist pattern is placed in `LOW_WHITELISTED` instead of the HIGH-risk report. For example: ```shell rm -rf /tmp/data; cat harmless.txt ``` The `rm -rf` component matches a HIGH-risk deletion rule, while `cat` matches the generic whitelist entry. Because the whitelist branch is evaluated first, the complete compound command is reported as whitelisted. Whitelist configuration also accepts arbitrary regular-expression metacharacters ...[truncated 1733 chars]- Remediation
View remediation