T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ensure_python_runtime.py:198- Finding
Unrestricted Local Python Script Execution Through Runtime Helper
- Content
View full analysis
int: completed = subprocess.run([runtime_path, script_path, *script_args]) return completed.returncode ``` ```python parser.add_argument("--apply", action="store_true", help="兼容开关：可直接重跑目标脚本，但不会自动安装系统依赖") parser.add_argument("--run-script", help="可选，指定一个目标脚本；如果有兼容解释器则直接用它运行") ``` ```python if args.apply: if current_supported and args.run_script: return_code = run_script_with_runtime(sys.executable, args.run_script, run_args) action_summary = pick_text(language, "已用当前兼容 Python 运行目标脚本", "Ran the target script with the current compatible Python") elif compatible_runtime and args.run_script: return_code = run_script_with_runtime(compatible_runtime["executable"], args.run_script, run_args) action_summary = pick_text(language, "已用兼容 Python 运行目标脚本", "Ran the target script with the compatible Python interpreter") ``` ### Technical Analysis The `--run-script` argument accepts an unrestricted filesystem path. When combined with `--apply`, that path is passed directly to a Python interpreter without path validation, repository containment, or an allowlist of approved project scripts. Although the subprocess call uses an argument array and is therefore not vulnerable to shell metacharacter injection, it still provides an arbitrary code-execution primitive: any readable Python file selected by the caller can be executed with the privileges of the current agent process. The repository already contains an `ensure_within_directory` helper in `scripts/common.py`, but this execution path does not use it. The behavior also conflicts with the documented statement in `SKILL.md` that `scripts/ensure_python_ru ...[truncated 1697 chars]- Remediation
View remediation
Path: scripts_dir = (Path(__file__).resolve().parent).resolve() candidate = Path(script_path).expanduser().resolve() try: candidate.relative_to(scripts_dir) except ValueError as exc: raise ValueError("Target script must remain inside the repository scripts directory") from exc if candidate.name not in ALLOWED_SCRIPTS or not candidate.is_file(): raise ValueError("Target script is not an approved executable script") return candidate ``` The validated resolved path should then be passed to `subprocess.ru ...[truncated 7 chars]