T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/audit_skill.py:278- Finding
Dangerous Operations in Bundled Scripts Are Not Analyzed
- Content
View full analysis
Vulnerability Details
File Location:
scripts/audit_skill.py, lines 278-310
Vulnerability Type: Incomplete security analysis of executable files
Risk Level: MediumVulnerable Code
python dangerous_patterns = [ r"rm\s+-rf\s+/", r"git\s+reset\s+--hard", r"curl\s+[^|]+\|\s*(sh|bash)", r"chmod\s+777", r"sudo\s+", r"eval\s+", r"DROP\s+TABLE", ] for pattern in dangerous_patterns: if re.search(pattern, text, flags=re.IGNORECASE): safety_penalties.append(10) findings.append(Finding("P1", "safety", f"Potentially dangerous command pattern found: {pattern}.", "Add explicit user approval, safer alternatives, or remove the command.", "SKILL.md")) break if has_any(lower_text, ["send email", "publish", "delete", "payment", "buy", "transfer", "deploy", "post to"]): if not has_any(lower_text, ["ask", "approval", "confirm", "explicit", "dry run", "preview"]): safety_penalties.append(8) findings.append(Finding("P1", "safety", "Sensitive external action lacks an approval gate.", "Require explicit user confirmation before external writes, payments, publishing, or destructive actions.", "SKILL.md")) if not has_any(body, ["output contract", "expected output", "report", "include:"]): market_penalties.append(5) findings.append(Finding("P2", "market", "No clear output contract.", "Tell downstream agents exactly what to return to the user.", "SKILL.md")) if sentence_count(body[:1200]) > 18: market_penalties.append(3) findings.append(Finding("P3", "market", "Opening section is dense.", "Make the first screen quick-start oriented.", "SKILL.md")) if len(body_words) > 3500: market_penalties.append(5) findings.append(Finding("P2", "market", "Skill body is very wordy.", "Move detailed references out of SKILL.md and keep only routing instructions.", "SKILL.md")) script_files = [p for p in all_files if "/s ...[truncated 3161 chars]- Remediation
View remediation
Remediation Suggestions
- Apply dangerous-operation checks to every supported executable file, not only to
SKILL.md. - Add language-aware checks for subprocess and shell execution, outbound network access, sensitive-file reads, persistence mechanisms, privilege changes, dynamic evaluation, obfuscation, and remote payload retrieval.
- Detect indirect execution patterns such as
subprocess.run,os.system,child_process, shell command substitution, interpreters invoked with downloaded content, and dynamically constructed commands. - Report unsupported or incompletely analyzed executable formats explicitly instead of awarding an unqualified safety score.
- Separate launch-readiness scoring from security-review status. A favorable launch score should not imply that bundled code is safe unless all executable content received adequate analysis.
- Use established static-analysis tools where available and document their coverage and limitations.
- Add regression tests containing malicious behavior in each supported script type and verify that the audit produces a safety finding.
- Consider failing closed or requiring manual review whenever executable code is present but cannot be comprehensively analyzed.
- Apply dangerous-operation checks to every supported executable file, not only to