T09 · Insecure Skill Coding Practices
Error
- Location
scripts/translation-assistant.sh:114- Finding
Arbitrary Python Code Execution Through a Crafted Filename
- Content
View full analysis
/dev/null; then echo "Detected language: Chinese (CN)" else echo "Detected language: English (EN)" fi ``` ### Technical Analysis The `cmd_parse` function obtains `file` from a command-line argument. Although the shell variable is enclosed in double quotes, its value is inserted directly into Python source code passed to `python3 -c`. Within the generated Python program, the filename is surrounded by single quotes: ```python f=open('$file','r') ``` A filename containing a single quote and additional Python syntax can terminate that string literal and alter the program executed by the Python interpreter. Shell quoting does not prevent this because the injection occurs at the Python-language parsing layer after shell expansion. The preceding `[ -f "$file" ]` validation does not eliminate the vulnerability. An attacker can create or distribute a real file whose name contains the necessary quote and syntax characters. Parsing that file causes the injected Python statements to run with the privileges of the user invoking the Skill. ### Attack Path 1. An attacker creates or supplies a document with a specially crafted filename containing a single quote and Python syntax. 2. The attacker persuades the user or an automated workflow to parse that document: ```bash translation-assistant.sh parse ``` 3. The shell confirms that the crafted path refers to an existing file. 4. The filename is interpolated into the string passed to `python3 -c`. 5. The crafted filename escapes the Py ...[truncated 844 chars]- Remediation
View remediation
/dev/null; then echo "Detected language: Chinese (CN)" else echo "Detected language: English (EN)" fi ``` Additional hardening should include: 1. Handle decoding failures explicitly instead of suppressing all diagnostics. 2. Avoid dynamic evaluation mechanisms such as `python3 -c` when practical; use a fixed helper script. 3. Add regression tests using filenames containing quotes, spaces, newlines, Unicode characters, and leading hyphens. 4. Run document-processing code with least privilege and limit access to unrelated user files. 5. Reject paths outside an approved workspace if the surrounding Skill runtime does not require unrestricted filesystem access. ]]>