T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:80- Finding
Arbitrary Node.js Code Execution Through Unsafe Data-File Evaluation
- Content
View full analysis
-tree-data.js','utf8') + ';globalThis.__D={META,NODES}'); const {META,NODES} = globalThis.__D; const ids = new Set(NODES.map(n=>n.id)); if (ids.size !== NODES.length) throw new Error('duplicate ids'); for (const n of NODES) if (n.parent && !ids.has(n.parent)) throw new Error('orphan '+n.id); if (!META.treeId || !META.builtUpTo) throw new Error('META incomplete'); console.log('OK', NODES.length, 'nodes | builtUpTo:', META.builtUpTo)" ``` ### Technical Analysis The prescribed smoke test reads the entire generated tree data file and passes its contents directly to JavaScript `eval()` in a Node.js process. The data file is maintained by the agent and contains conversation-derived content. Consequently, it cannot safely be treated as trusted executable code. Node.js `eval()` executes with the permissions and module context of the validation process. A malicious statement introduced into the data file can access Node.js APIs, including filesystem, environment, process, child-process, and network functionality. The documented restrictions on backticks and `${` sequences do not constitute a security boundary and do not prevent arbitrary JavaScript statements from being placed outside the expected data values. ### Attack Path 1. An attacker supplies crafted conversation or repository content intended to be incorporated into the dialog-tree data file. 2. The generated `-tree-data.js` file contains attacker-controlled JavaScript outside, or escaping from, the expected data structure. 3. The agent follows the mandatory post-edit verification procedure. 4. Node.js reads the complete file and executes it through `eval()`. 5. The injected code runs with the operating-system permissions of the user running the agent. ### I ...[truncated 417 chars]- Remediation
View remediation