T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/code_validator.py:119
- Finding
- Strategy Validation Executes Untrusted Python Code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/code_validator.py:119-151` **Vulnerability Type**: Unrestricted execution of untrusted code during validation **Risk Level**: High ### Vulnerable Code ```python def _check_imports(self, filepath: Path): """Check for import errors""" try: # Create a temporary test script with tempfile.NamedTemporaryFile(mode='w', suffix='.py', delete=False) as f: test_script = """ import sys import os # Try to add common paths script_dir = os.path.dirname(os.path.abspath(__file__)) parent_dir = os.path.dirname(script_dir) sys.path.insert(0, parent_dir) sys.path.insert(0, os.path.join(parent_dir, 'api_wrappers')) try: import {module_name} print("SUCCESS: Import successful") except ImportError as e: print("IMPORT_ERROR: " + str(e)) except SyntaxError as e: print("SYNTAX_ERROR: " + str(e)) except Exception as e: print("OTHER_ERROR: " + str(e)) """.format(module_name=filepath.stem) f.write(test_script) temp_file = f.name # Run the test script result = subprocess.run( [self.python_executable, temp_file], capture_output=True, text=True, cwd=filepath.parent, timeout=10 ) ``` ### Technical Analysis The validator checks imports by launching a Python subprocess that imports the target strategy module. Python imports execute all top-level statements in the imported file. Consequently, this operation is not a passive validation step: it gives the strategy file the ability to execute arbitrary Python code. The subprocess inherits the validator's user identity, environment variables, filesystem access, and network access. There is no sandbox, environment sanitization, privilege reduction, read-only filesystem, or network restriction. The timeout only limits execution duration and does not prevent immediate actions such as reading environment credentials, modify ...[truncated 1939 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove runtime imports from the default validation workflow. 2. Use non-executing checks such as: - `ast.parse()` for syntax and structural analysis. - `python -m py_compile` for compilation checks. - Static import discovery and allowlist-based module resolution. 3. Treat generated and user-supplied strategies as untrusted executable code. 4. If runtime verification is indispensable, run it in a dedicated sandbox or disposable container with: - No API keys, tokens, or other secrets in the environment. - Network access disabled by default. - A read-only project mount and isolated temporary output directory. - A non-privileged user and no additional Linux capabilities. - CPU, memory, process-count, and execution-time limits. - No access to host sockets, home directories, or sensitive configuration. 5. Require explicit user confirmation before executing a strategy and clearly state that import validation runs strategy code. 6. Generate the temporary helper securely, ensure cleanup in a `finally` block, and avoid module-name interpolation where possible. ]]>