T09 · Insecure Skill Coding Practices
Warning
- Location
references/ppt-production-guide.md:116- Finding
Unsafe shell profile execution during API capability checks
- Content
View full analysis
/dev/null 2>&1 || true; printf "OPENAI_BASE_URL=%s\n" "${OPENAI_BASE_URL:-}"; if [ -n "${OPENAI_API_KEY:-}" ]; then echo "OPENAI_API_KEY=present"; else echo "OPENAI_API_KEY=missing"; fi; curl -sS -H "Authorization: Bearer ${OPENAI_API_KEY}" "${OPENAI_BASE_URL%/}/models" | python3 -c "import sys,json; data=json.load(sys.stdin); ids=[m.get(\"id\",\"\") for m in data.get(\"data\",[])]; print(\"gpt-image-2 available=\" + str(any(i==\"gpt-image-2\" for i in ids))); print(\"model_count=\" + str(len(ids)))"' ``` ### Technical Analysis The documented API check explicitly sources `~/.zshrc`. A shell initialization file is executable shell code rather than a structured configuration file. It may contain commands, command substitutions, plugin bootstrap logic, functions, aliases, network operations, or references to other mutable scripts. Consequently, invoking this check executes every command in the profile with the privileges of the user running the Skill. This exceeds the minimum action necessary to determine whether two environment variables are present and query an API endpoint. Suppressing standard output and standard error does not provide isolation. It only conceals output from commands executed by the profile. The `|| true` clause also suppresses profile-loading failures, potentially hiding indicators that unintended commands ran. This is not the `curl | bash` pattern reported by the static pre-scan. The response from `curl` is passed to a fixed Python JSON parser and is not executed as shell code. No remote payload retrieval and execution was identified. The actual concern is execution of arbitrary local startup-file content before the API query. ### Attack Path 1. An attacker, compromised shell plugin ...[truncated 1450 chars]- Remediation
View remediation