T09 · Insecure Skill Coding Practices
Error
- Location
scripts/chart_generator.py:111- Finding
Unsandboxed Execution of Generated Python Code
- Content
View full analysis
tuple: """ Execute generated Matplotlib code and return (success, output_path, error). """ import os, sys, tempfile try: output_dir = os.path.join(os.path.expanduser("~"), ".qclaw", "workspace", "outputs") os.makedirs(output_dir, exist_ok=True) # Write the code to a temporary file and execute it code_path = os.path.join(output_dir, "_temp_chart.py") with open(code_path, "w", encoding="utf-8") as f: f.write(code) import subprocess result = subprocess.run( ["python", code_path], capture_output=True, text=True, timeout=60, cwd=output_dir ) ``` ### Technical Analysis The `execute_chart_code` function accepts a Python source string, writes it to a predictable local file, and executes it using the system Python interpreter. There is no validation of the source code, AST inspection, import allowlist, operating-system sandbox, privilege restriction, network isolation, or user confirmation. The surrounding chart-generation module builds prompts asking an LLM to produce executable Python. If attacker-controlled paper content influences the generated response, or if the LLM/API is compromised, the returned chart code can contain arbitrary Python operations instead of only Matplotlib drawing instructions. Using `shell=False` does not mitigate this issue because the attacker controls the contents of the Python file rather than the subprocess command-line arguments. The executed program receives the same filesystem access, environment variables, network access, and operating-system identity as the Agent process. The fixed `_temp_chart.py` filename also cr ...[truncated 1595 chars]- Remediation
View remediation