T09 · Insecure Skill Coding Practices
- Location
scripts/08_build_xlsx.py:52- Finding
Arbitrary Python Execution Through Shared Temporary-Directory Wildcards
- Content
View full analysis
Vulnerability Details
File Location:
scripts/08_build_xlsx.py, lines 52–62
Vulnerability Type: Execution of untrusted Python files from a shared temporary directory
Risk Level: HighVulnerable Code
python CASES = [] for f in sorted(glob.glob('/tmp/cb_rows*.py')): ns = {} exec(open(f, encoding='utf-8').read(), ns) CASES += ns.get('CASES', []) print('CASES:', len(CASES), '| Unique tid:', len({c['tid'] for c in CASES})) MAN = {} POST = {} for f in sorted(glob.glob('/tmp/tcb*.py')): ns = {} exec(open(f, encoding='utf-8').read(), ns) MAN.update(ns.get('MAN', {})) POST.update(ns.get('POST', {}))Technical Analysis
The workbook builder discovers Python files using broad wildcard patterns in the system-wide
/tmpdirectory and executes every matching file withexec(). It does not enforce an explicit file manifest, validate ownership or permissions, reject symbolic links, or verify that resolved paths belong to a private workspace.Although the Skill documentation says to use only reviewed writing files, that requirement is not enforced in the execution path. On systems where
/tmpis shared among users or processes, an independent local attacker can introduce an additional matching file. Its contents will then execute with the identity and privileges of the user running the Skill.This is an exploitable coding flaw, not evidence that the packaged project itself contains an intentionally malicious payload.
Attack Path
- An attacker with access to the same host creates a file such as
/tmp/cb_rows_attacker.pyor/tmp/tcb_attacker.py. - The file contains arbitrary Python statements and may optionally define the expected variables to avoid an immediate build failure.
- The victim follows the documented workflow and runs
scripts/08_build_xlsx.py. glob.glob()includes the attacker-created file without distinguishing it from reviewed ...[truncated 839 chars]
- An attacker with access to the same host creates a file such as
- Remediation
View remediation
Remediation Suggestions
- Replace executable Python data files with a non-executable format such as JSON and validate the parsed schema before use.
- Store all intermediate files in a private workspace created with mode
0700, rather than in the shared/tmpnamespace. - Replace wildcard discovery with an explicit manifest of files created and reviewed for the current run.
- Resolve each candidate with
Path.resolve()and verify that it remains beneath the intended private workspace. - Reject symbolic links and non-regular files, and verify that each file is owned by the current user and is not writable by group or others.
- If Python modules remain necessary, avoid unrestricted
exec()and isolate execution in a sandboxed, least-privileged process with no unnecessary credentials or network access. - Generate unpredictable per-run directories with secure APIs such as
tempfile.TemporaryDirectory()and pass the workspace path explicitly through the build pipeline.