T09 · Insecure Skill Coding Practices
Error
- Location
scripts/chart_generator.py:111- Finding
Unsandboxed Execution of Generated Python Chart Code
- Content
View full analysis
tuple: """ Execute generated Matplotlib code and return (success, output_path, error). """ import os, sys, tempfile try: output_dir = os.path.join( os.path.expanduser("~"), ".qclaw", "workspace", "outputs" ) os.makedirs(output_dir, exist_ok=True) # Write code into a temporary file and execute it code_path = os.path.join(output_dir, "_temp_chart.py") with open(code_path, "w", encoding="utf-8") as f: f.write(code) import subprocess result = subprocess.run( ["python", code_path], capture_output=True, text=True, timeout=60, cwd=output_dir ) os.remove(code_path) ``` ### Technical Analysis The function accepts an unrestricted string, writes it as a Python program, and executes it with the normal privileges of the Skill process. No validation limits the program to Matplotlib operations. There is no AST allowlist, import restriction, filesystem isolation, network isolation, operating-system sandbox, or dedicated low-privilege account. The surrounding module is designed to ask an LLM to produce chart code. If an integration passes an LLM response to this executor, malicious content in a paper or a compromised model response can become executable Python. A timeout only limits runtime; it does not prevent immediate file access, command execution, network requests, credential theft, or process creation. Repository-wide reference analysis did not identify a current call from the primary `draw.py` workflow. The vulnerability is therefore a packaged, callable capability rather than an automatically reached path in the ...[truncated 1794 chars]- Remediation
View remediation