T09 · Insecure Skill Coding Practices
Error
- Location
scripts/desktop_agent.py:257- Finding
Shell Command Injection in Arbitrary Application Launching
- Content
View full analysis
bool: """打开应用程序""" try: # 常见应用名映射 app_map = { "notepad": "notepad.exe", "记事本": "notepad.exe", "calc": "calc.exe", "计算器": "calc.exe", "explorer": "explorer.exe", "chrome": "start chrome", "edge": "start msedge", "微信": r"WeChat\WeChat.exe", "wechat": r"Weixin\Weixin.exe", "weixin": r"Weixin\Weixin.exe", "code": "code", } cmd = app_map.get(app_name.lower(), app_name) subprocess.Popen(cmd, shell=True) ``` ### Technical Analysis When `app_name` is not present in `app_map`, the value is used directly as `cmd`. It is then passed to `subprocess.Popen` with `shell=True`. On Windows, this causes the command to be interpreted by the command shell, including metacharacters such as `&`, `|`, `>`, and command grouping syntax. The value can originate from either: - The command-line interface in `scripts/desktop_agent.py`, where `sys.argv[2]` is passed to `open_app`. - An LLM-generated `open_app` step in `scripts/task_executor.py`, where the `app` field is not constrained to an allowlist. Although `SAFE_APPS` exists in `scripts/safety.py`, it is never enforced. Therefore, neither direct callers nor planner-generated steps are restricted to known executables. ### Attack Path 1. An attacker supplies a crafted application name through the direct CLI or a natural-language task. 2. For a direct invocation, the attacker can request an application value containing shell syntax, such as an otherwise valid program name followed by an additional command. 3. For natural-language execution, the local LLM can return a plan similar to: ` ...[truncated 1214 chars]- Remediation
View remediation