T09 · Insecure Skill Coding Practices
- Location
scripts/task_runner.py:106- Finding
Untrusted Skill Instructions Execute in an Unrestricted Agent Session
- Content
View full analysis
Vulnerability Details
File Location:
scripts/task_runner.py:106-112, 122-130
Vulnerability Type: Untrusted instruction execution without an enforced sandbox
Risk Level: HighVulnerable Code
python def _build_prompt(self, skill_content: str, task: dict) -> str: """Prepend SKILL.md content to the task prompt.""" return ( f"You have been given the following skill documentation to guide your work:\n\n" f"---BEGIN SKILL.MD---\n{skill_content}\n---END SKILL.MD---\n\n" f"Task: {task['prompt']}" )python cmd = ["claude", "-p", "--output-format", "json"] if self.model: cmd.extend(["--model", self.model]) result = subprocess.run( cmd, input=prompt, capture_output=True, text=True, timeout=timeout, )Technical Analysis
Candidate Skill content and task-suite prompts are evaluation inputs that may be attacker-controlled. The evaluator inserts both directly into an instruction prompt and launches
claude -pwithout explicitly disabling tools, restricting network access, isolating the filesystem, removing credentials, or enforcing a sandbox.The
BEGIN SKILL.MDandEND SKILL.MDmarkers are only textual delimiters; they do not create a security boundary. A malicious candidate can place instructions in its Skill content that direct the agent to perform actions unrelated to evaluation. The actual actions available depend on the host's Claude CLI configuration and permissions, but this code does not independently enforce least privilege.The subprocess call uses an argument list rather than a shell command, so this is not conventional shell injection. The vulnerability is instruction-driven use of ambient agent capabilities.
Attack Path
- An attacker places malicious instructions in a candidate's
skill_content,content, orbodyfield. - Pipeline evaluation selects that candidate and passes its content to
TaskRunner.run(). _build_prompt()presents the c ...[truncated 1001 chars]
- An attacker places malicious instructions in a candidate's
- Remediation
View remediation
Remediation Suggestions
- Run each candidate evaluation in an isolated container or sandbox using a dedicated unprivileged account.
- Disable agent tools for text-only evaluation tasks. If tools are indispensable, use a minimal allowlist and deny arbitrary shell, filesystem, and network access.
- Remove API keys, tokens, SSH agents, cloud credentials, and unrelated environment variables from the evaluation process.
- Use a read-only root filesystem, a fresh writable temporary directory, and explicit CPU, memory, process, and execution-time limits.
- Disable outbound network access unless a task explicitly requires it; then allowlist only required destinations.
- Treat candidate Skill content as hostile data rather than trusted operational instructions. Use a purpose-built evaluation harness with a fixed higher-priority policy that prohibits side effects.
- Add adversarial tests containing instructions to read files, invoke tools, access the network, or override the task, and verify that the sandbox blocks every attempted side effect.
- Record attempted tool calls and fail the evaluation if a text-only task tries to perform external actions.