T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/critique_10khr_runner.py:402
- Finding
- Automated assessment executes untrusted Skill code## Vulnerability Details **File Location**: `scripts/critique_10khr_runner.py:402-407, 586-592, 218-250`; triggered by `SKILL.md:132` and `scripts/10khr_cron_verify.py:149-152` **Vulnerability Type**: Execution of untrusted code during automated static assessment **Risk Level**: High ### Technical Analysis The Skill instructs autonomous workflows to run the verifier first: ```markdown - [ ] Run `python3 scripts/10khr_cron_verify.py` FIRST in any autonomous pass — its output is authoritative for what to grind ``` The verifier imports the runner and assesses discovered Skills: ```python runner = load_runner() state = runner.load_state() assessment = runner.run_full_assessment() ``` During assessment, the runner executes each target Skill's unittest suite: ```python tdir = os.path.join(skill_dir, "tests") if not (os.path.isdir(tdir) and glob.glob(os.path.join(tdir, "test_*.py"))): score -= 2; findings.append("no tests") else: rc, out = _run( [sys.executable, "-m", "unittest", "discover", "-s", "tests"], cwd=skill_dir ) if rc != 0: score -= 2 findings.append( "tests FAIL: " + (out.strip().splitlines() or ["?"])[-1][:60] ) ``` It also executes Python and shell scripts with `--help` because execution checks are enabled: ```python SCRIPT_TIMEOUT = 30 EXECUTE_CHECKS = True ``` ```python if execute: cmd = ( ["bash", name, "--help"] if name.endswith(".sh") else [sys.executable, name, "--help"] ) rc, _ = _run(cmd, cwd=script_dir) ok.append(name) if rc == 0 else broken.append( "%s (rc=%d)" % (name, rc) ) ``` ```python script_dir = os.path.join(skill_dir, "scripts") _ok, broken_help, _n = check_scripts_help( script_dir, execute=EXECUTE_CHECKS ) ``` The assessment recursively discovers `ocas-*` and `util-*` Skills from profile directories. A Skill author controls its `tests/test_*.py`, `scripts/*.py`, and `scripts/*.sh` files. Python mod ...[truncated 2029 chars]
- Remediation
- ## Remediation Suggestions - Make assessment static by default. Set `EXECUTE_CHECKS = False` and remove direct unittest discovery from untrusted Skill assessment. - Do not use a textual outbound-operation blacklist as an authorization or execution boundary. - Analyze scripts using source parsing and AST inspection without importing or executing target modules. - If runtime validation is necessary, run it only in a disposable sandbox with: - No inherited credentials or sensitive environment variables. - No network access. - A read-only copy of the target. - No access to home directories or shared Skill/profile state. - Strict CPU, memory, process, and time limits. - A non-privileged, dedicated OS identity. - Require explicit user approval that identifies the exact Skill and files before any runtime validation. - Separate static assessment from opt-in dynamic testing, and clearly label dynamic testing as execution of untrusted code. - Apply the same isolation requirements to test suites, `--help` checks, import checks, and any PII gate scripts.