T09 · Insecure Skill Coding Practices
Error
- Location
skills/amazon-niche-radar/scripts/response_io.py:61- Finding
Unrestricted Python Script Execution Through a Generic Wrapper
- Content
View full analysis
Path: p = Path(script_arg).expanduser() if not p.is_absolute(): # Resolve relative to the current working directory the agent invoked from. p = (Path.cwd() / p).resolve() else: p = p.resolve() if not p.is_file(): _err(f"--script path not found: {p}") return p ``` ```python child_env = os.environ.copy() child_env["PYTHONIOENCODING"] = "utf-8" proc = subprocess.run( [sys.executable, str(main_script), params_str], capture_output=True, text=True, encoding="utf-8", errors="replace", env=child_env, timeout=args.timeout, ) ``` ### Technical Analysis The wrapper accepts an arbitrary path through `--script`, resolves it, and verifies only that it is a file. It does not require the target to reside in the expected Skill directory and does not restrict execution to an allowlist of known entry points. The selected file is then executed by the current Python interpreter. The child process receives a complete copy of the parent environment, which can include `LINKFOX_AGENT_API_KEY`, session identifiers, workspace paths, and other credentials. This creates a local code-execution primitive when an attacker can influence the wrapper arguments or place a Python file at a path accessible to the Agent. ### Attack Path 1. An attacker causes a Python file to be written into the workspace or identifies another attacker-controlled readable path. 2. Through prompt or argument manipulation, the attacker induces the Agent to invoke `response_io.py run` with that file as `--script`. 3. `_resolve_script()` accepts the file because it performs no directory-boundary or entry-point validation. 4. `subprocess.run()` exe ...[truncated 635 chars]- Remediation
View remediation