T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:11
- Finding
- Execution of Unbundled Code Outside the Skill Trust Boundary<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 11-26 **Vulnerability Type**: External unverified code execution through a mutable relative path **Risk Level**: Medium ### Vulnerable Code ```markdown ## Project Location ``` {baseDir}/../../agents/polymarket-bot/PolyAnalysis/ ``` Activate the virtualenv before running any script: ```bash cd {baseDir}/../../agents/polymarket-bot/PolyAnalysis source .venv/bin/activate ``` ## Quick Commands ### Analyze a single wallet ```bash python analyze.py <address> ``` ``` ### Technical Analysis The skill directs the agent to traverse outside the audited project directory, activate an external Python virtual environment, and execute an external `analyze.py` script. Neither that script nor the virtual environment and its installed dependencies are included in the audited artifact. Consequently, the effective executable behavior cannot be established from the reviewed skill package. The relative traversal through `../../agents/` also makes execution dependent on mutable files outside the skill's trust boundary. Activating `.venv` modifies shell environment variables, including `PATH`, before invoking `python`, so both the interpreter and the target script originate from the unaudited external directory. This is an insecure trust-boundary design rather than evidence that the external code is currently malicious. Exploitation requires an attacker to gain write access to the referenced directory, virtual environment, or a path component used to resolve it. ### Attack Path 1. An attacker obtains the ability to create or modify files under the externally referenced `agents/polymarket-bot/PolyAnalysis` directory. 2. The attacker replaces `analyze.py`, modifies the virtual environment's Python interpreter or activation script, or introduces a malicious imported module. 3. A user asks the agent to analyze a wallet or run the discovery workflow. 4. Following `SKILL.md`, the agent changes into the ex ...[truncated 905 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bundle `analyze.py` and all required application modules inside the skill package so that the reviewed artifact contains the complete executable behavior. 2. Include a locked dependency manifest with exact versions and cryptographic hashes, and install dependencies from an explicitly trusted package source. 3. Avoid sourcing an externally managed virtual environment. Invoke a verified interpreter through an absolute, canonical path instead. 4. Resolve the execution directory to its canonical path and verify that it remains within an approved skill-owned directory before running code. 5. Reject symbolic links, unexpected ownership, or writable path components that could redirect execution to attacker-controlled content. 6. Verify packaged scripts and runtime components against signed manifests or trusted checksums before execution. 7. Run the analysis process in a sandbox with minimal filesystem access, restricted environment variables, no unnecessary credentials, and network access limited to the documented Polymarket and RPC endpoints. 8. Document all required external resources and credential access so operators can apply least-privilege controls. ]]>