T09 · Insecure Skill Coding Practices
Error
- Location
scripts/predict.sh:7- Finding
Arbitrary Local Command Execution Through Python Source Injection
- Content
View full analysis
/dev/null || echo "{}") ``` ### Technical Analysis The script inserts the user-controlled `TEXT`, `PLATFORM`, and `HISTORY` variables directly into Python source code passed to `python3 -c`. Quoting the shell variables does not make them safe for inclusion in Python syntax. The `HISTORY` value is especially straightforward to exploit because it is inserted as an unquoted Python expression: ```python 'historyCount': $HISTORY ``` An attacker can provide an arbitrary valid Python expression instead of an integer. Python evaluates that expression while constructing the dictionary. Expressions using modules such as `os` or `subprocess` can therefore execute operating-system commands. The `TEXT` and `PLATFORM` parameters are also unsafe. Crafted values can terminate their surrounding Python string literals and inject additional Python syntax. The use of triple quotes around `TEXT` does not prevent injection because the attacker can include a matching triple-quote sequence. The fallback `|| echo "{}"` does not mitigate the vulnerability. Injected commands execute before Python exits, even if the resulting Python program later raises an exception. ### Attack Path 1. An attacker controls or influences arguments supplied to `scripts/predict.sh`. This can occur through direct CLI access or through an Agent that incorpor ...[truncated 1606 chars]- Remediation
View remediation
&2 exit 1 } PAYLOAD=$(python3 - "$TEXT" "$PLATFORM" "$HISTORY" <<'PY' import json import sys text = sys.argv[1] platform = sys.argv[2] history_count = int(sys.argv[3]) print(json.dumps({ "text": text, "platform": platform, "historyCount": history_count, })) PY ) ``` Additional hardening measures should include: 1. Validate that `--history` contains only an integer within an expected range. 2. Restrict `--platform` to an explicit allowlist of supported platform identifiers. 3. Reject missing option values instead of relying on positional expansion. 4. Preserve content as opaque data and never evaluate it as shell, Python, or template syntax. 5. Add regression tests containing quotes, triple quotes, newlines, Python expressions, and shell metacharacters. 6. Run the Skill with least privilege and without unnecessary access to credentials or sensitive files to limit impact if another injection flaw is introduced. ]]>