T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run.py:61- Finding
Arbitrary Python File Execution Through Path Traversal
- Content
View full analysis
int: """Run a script with the virtual environment""" script_path = self.skill_dir / "scripts" / script_name if not script_path.exists(): print(f"❌ Script not found: {script_path}") return 1 # Ensure venv is set up if not self.ensure_venv(): print("❌ Failed to set up environment") return 1 # Build command cmd = [str(self.venv_python), str(script_path)] if args: cmd.extend(args) print(f"🚀 Running: {script_name} with venv Python") try: # Run the script with venv Python result = subprocess.run(cmd) ``` ### Technical Analysis Both entry points accept a caller-controlled script name and append it ...[truncated 1691 chars]- Remediation
View remediation