T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:11- Finding
Execution of Unbundled Code Outside the Skill Trust Boundary
- Content
View full analysis
``` ``` ### Technical Analysis The skill directs the agent to traverse outside the audited project directory, activate an external Python virtual environment, and execute an external `analyze.py` script. Neither that script nor the virtual environment and its installed dependencies are included in the audited artifact. Consequently, the effective executable behavior cannot be established from the reviewed skill package. The relative traversal through `../../agents/` also makes execution dependent on mutable files outside the skill's trust boundary. Activating `.venv` modifies shell environment variables, including `PATH`, before invoking `python`, so both the interpreter and the target script originate from the unaudited external directory. This is an insecure trust-boundary design rather than evidence that the external code is currently malicious. Exploitation requires an attacker to gain write access to the referenced directory, virtual environment, or a path component used to resolve it. ### Attack Path 1. An attacker obtains the ability to create or modify files under the externally referenced `agents/polymarket-bot/PolyAnalysis` directory. 2. The attacker replaces `analyze.py`, modifies the virtual environment's Python interpreter or activation script, or introduces a malicious imported module. 3. A user asks the agent to analyze a wallet or run the discovery workflow. 4. Following `SKILL.md`, the agent changes into the ex ...[truncated 905 chars]- Remediation
View remediation