T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:39
- Finding
- Unsafe Sourcing of a Global Environment File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39-44 **Vulnerability Type**: Unsafe shell configuration loading and excessive secret exposure **Risk Level**: Medium ### Vulnerable Code ```bash All commands run from this skill directory: ```bash cd ~/clawd/skills/arena-research source ~/.config/env/global.env ``` ``` ### Technical Analysis The Skill directs the agent to load `~/.config/env/global.env` with the shell built-in `source`. Sourcing a file executes its contents as shell code in the current shell; it does not merely parse environment variable assignments. This creates two security concerns: 1. Any command, function definition, alias, command substitution, or other shell construct present in the file will execute with the privileges of the account running the Skill. 2. A global environment file may expose credentials unrelated to Are.na to the Skill process and any subsequently executed CLI code, violating least privilege. The supplied artifact does not contain evidence that the environment file has been compromised or that its contents are exfiltrated. Exploitation therefore depends on an attacker or another untrusted component being able to modify that external file. ### Attack Path 1. An attacker gains the ability to modify `~/.config/env/global.env`, such as through another compromised local tool, an insecure installation process, or incorrect file permissions. 2. The attacker adds a shell command or command substitution to the file. 3. An agent follows the initialization instructions in `SKILL.md` and runs `source ~/.config/env/global.env`. 4. The injected statement executes in the current shell under the agent user's account. 5. The malicious statement can access files and environment variables available to that account, alter the process environment, or affect the subsequently invoked CLI. ### Impact Assessment Successful exploitation provides command execution with the privileges of the user running the Skil ...[truncated 255 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the instruction to source the global shell environment file. - Supply only the required credential directly to the process, for example through a narrowly scoped process environment: ```bash ARENA_ACCESS_TOKEN="${ARENA_ACCESS_TOKEN:?ARENA_ACCESS_TOKEN is required}" \ bun run arena-search.ts search "<query>" ``` - If file-based configuration is required, use a dedicated Are.na configuration file containing only `ARENA_ACCESS_TOKEN`. - Parse the configuration file as data rather than executing it as shell code. Reject unknown keys and malformed values. - Restrict the dedicated configuration file to the owning user, such as mode `0600`, and verify its ownership before reading it. - Ensure the CLI does not log tokens, include them in saved research output, or expose them in error messages. - Run the CLI with the minimum necessary environment instead of inheriting unrelated credentials from a global configuration. ]]>