T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/base/mimo-tts.sh:30
- Finding
- Arbitrary Python Code Execution Through Unsafe Heredoc Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/base/mimo-tts.sh:30-38` **Vulnerability Type**: Command injection through generated Python source **Risk Level**: High ### Vulnerable Code ```bash python3 - <<PY import json body={ 'model':'mimo-v2-tts', 'messages':[{'role':'user','content':'请朗读'},{'role':'assistant','content':"""$TEXT"""}], 'audio':{'format':'wav','voice':'$VOICE'} } print(json.dumps(body,ensure_ascii=False,indent=2)) PY ``` ### Technical Analysis The script places the user-controlled `TEXT` value and configurable `VOICE` value directly into Python source code contained in an unquoted heredoc. These values are not encoded as Python string literals before interpolation. An attacker can supply text containing a terminating triple quote followed by arbitrary Python statements. When the script is run with `--dry-run`, the generated source is passed to the local Python interpreter. The injected statements therefore execute as code rather than remaining TTS content. Shell argument quoting at the call site does not mitigate the vulnerability because the injection occurs when the script constructs a second programming-language context. ### Attack Path 1. An attacker supplies crafted TTS text containing a sequence that closes the Python triple-quoted string. 2. The attacker or an automation path invokes the base implementation in dry-run mode, for example: ```bash scripts/base/mimo-tts.sh '"""; import os; os.system("id"); x="""' output.ogg --dry-run ``` 3. The shell interpolates the crafted text into the heredoc. 4. Python parses the injected statements as part of the generated program. 5. The injected command executes with the operating-system privileges and environment inherited by the Skill process. Exploitation requires access to the dry-run path in `scripts/base/mimo-tts.sh`; normal callers that do not enable this option do not reach the vulnerable heredoc. ### Impact Assessment Successful exploitation prov ...[truncated 516 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Do not construct executable source code using interpolated user input. 1. Replace the generated Python program with static code. 2. Pass `TEXT` and `VOICE` through positional arguments, standard input, or environment variables. 3. Let `json.dumps` encode these values rather than attempting to place them inside Python string literals. 4. Alternatively, construct the preview with `jq --arg`, which safely JSON-encodes shell values. 5. Add regression tests containing triple quotes, backslashes, newlines, Unicode, and Python syntax. A safer implementation using environment variables is: ```bash TEXT="$TEXT" VOICE="$VOICE" python3 - <<'PY' import json import os body = { "model": "mimo-v2-tts", "messages": [ {"role": "user", "content": "请朗读"}, {"role": "assistant", "content": os.environ["TEXT"]}, ], "audio": { "format": "wav", "voice": os.environ["VOICE"], }, } print(json.dumps(body, ensure_ascii=False, indent=2)) PY ``` The quoted heredoc delimiter prevents shell expansion, while Python reads the input strictly as data. ]]>