T09 · Insecure Skill Coding Practices
- Location
__init__.py:90- Finding
Unrestricted PowerShell Command Execution
- Content
View full analysis
Vulnerability Details
File Location:
__init__.py:90-97
Vulnerability Type: Arbitrary command execution through an unrestricted PowerShell interface
Risk Level: HighVulnerable Code
python def windows_command(command: str) -> str: """Run a PowerShell or cmd command.""" result = subprocess.run( ["powershell", "-Command", command], capture_output=True, text=True ) return result.stdout if result.stdout else result.stderrTechnical Analysis
The
commandparameter is passed directly topowershell -Command. PowerShell treats this value as executable script text, including pipelines, command substitution, network operations, file-system changes, and invocation of additional programs.The function does not enforce an operation allowlist, validate command structure, restrict executable targets, require approval for destructive operations, apply a timeout, or run the process in a sandbox. Although command execution is a documented feature, exposing an unrestricted interpreter as an agent-callable tool creates a high-impact confused-deputy boundary. Malicious instructions from untrusted task content could induce the agent to execute commands unrelated to the user's intended task.
This does not independently elevate privileges: commands execute with the permissions and security context of the process hosting the skill.
Attack Path
- An attacker supplies malicious instructions through content processed by the agent, or a user directly requests an unsafe operation.
- The agent passes attacker-controlled PowerShell text to
windows_command. - The function invokes
powershell -Commandwithout validation or confirmation. - PowerShell interprets the complete value as executable code.
- The command may modify or delete accessible files, launch programs, access local data, perform network requests, or download and execute additional content un ...[truncated 531 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the generic command interpreter unless unrestricted shell access is essential to the skill.
- Replace it with narrowly scoped functions that accept structured parameters and invoke fixed executables with explicit argument arrays.
- Maintain an allowlist of permitted operations, executables, arguments, and target paths.
- Reject shell metacharacters and script constructs where free-form text cannot be eliminated, while recognizing that filtering alone is not a reliable sandbox.
- Require explicit user confirmation immediately before commands that write files, change configuration, install software, start processes, or access the network.
- Run permitted operations in a sandboxed, non-administrative process with restricted file-system and network access.
- Add execution timeouts, output limits, cancellation support, and security logging.
- Clearly display the exact command and execution context to the user before approval.