T09 · Insecure Skill Coding Practices
Error
- Location
references/pre-push-check-template.sh:43- Finding
Pre-push validation executes repository-controlled JavaScript
- Content
View full analysis
/dev/null || node --check js/copy.js 2>/dev/null; then echo " ✅ copy.js parses OK" else # ES module — try dynamic import if node -e "import('./js/copy.js').catch(()=>{})" 2>/dev/null; then echo " ✅ copy.js ES module OK" else echo " ⚠️ copy.js syntax could not be validated (ES module)" fi fi # 4. main.js syntax check echo "" echo "4. main.js syntax..." node -e "import('./js/main.js').catch(()=>{})" 2>/dev/null && echo " ✅ main.js OK" || echo " ⚠️ main.js could not be validated" ``` ### Technical Analysis The validation template uses Node.js `require()` and dynamic `import()` to check whether generated JavaScript files are syntactically valid. Both operations execute all top-level statements in the imported module; they are not parsing-only operations. Because the Skill directs users to install this script as a repository pre-push hook, repository-controlled code in `js/copy.js` or `js/main.js` is executed automatically when a developer pushes changes. A malicious module could invoke Node.js APIs such as `child_process`, access files available to the developer account, modify repository content, or initiate network connections. The dynamic import checks also use `.catch(()=>{})`, which suppresses rejected import promises. Consequently, some module loading or runtime errors may be treated as successful validation, reducing the effectiveness of the security gate. ### Attack Path 1. An attacker contributes or compromises `js/copy.js` or `js/main.js`. 2. The attacker places a malicious top-level statement in the affected module. 3. A developer checks out or merges the changes. 4. Following the S ...[truncated 830 chars]- Remediation
View remediation
{})`. Any parser or module-format error must set `FAIL=1` or terminate with a nonzero exit status. 5. Run static validation in an isolated environment with no secrets and restricted filesystem and network access as defense in depth. 6. Add a regression test containing a harmless top-level side effect and verify that validation does not execute it. ]]>