T09 · Insecure Skill Coding Practices
Error
- Location
scripts/send_video.sh:47- Finding
Python Source Injection Through Untrusted Video Path Interpolation
- Content
View full analysis
/dev/null || echo 0) ``` ### Technical Analysis The script embeds `FFPROBE_BIN` and `VIDEO_FILE` directly into a dynamically constructed Python program. Shell quoting of `"$VIDEO_FILE"` when assigning the variable does not make the value safe for later insertion into Python source code. A video filename containing quotes and Python syntax can terminate the intended Python string, close the `subprocess.run` invocation, and append attacker-controlled statements. The resulting code is passed to `python3 -c` and runs with the same privileges and environment as the Skill. Using an argument-array form for the eventual FFprobe operation does not mitigate this issue because injection occurs while constructing the surrounding Python source, before `subprocess.run` receives its arguments. The `FFPROBE` environment value is interpolated through the same unsafe mechanism. Although controlling the execution environment may already provide significant influence, it should still be treated as data rather than executable Python syntax. ### Attack Path 1. An attacker supplies, uploads, or causes the workflow to process a video with a filename containing crafted Python syntax. 2. The Skill invokes `send_video.sh` with the attacker-controlled path as `VIDEO_FILE`. 3. The script successfully uploads the file or proceeds to duration processing. 4. Lines 48–52 insert the malicious filename into the body of the `python3 ...[truncated 1284 chars]- Remediation
View remediation