T09 · Insecure Skill Coding Practices
- Location
references/execution-protocol.md:22- Finding
Arbitrary Shell Command Execution Through Mutable Telemetry Configuration
- Content
View full analysis
Vulnerability Details
File Location:
references/execution-protocol.md, lines 22-27
Vulnerability Type: Command injection through unvalidated configuration
Risk Level: HighVulnerable Code Snippet
markdown ### Step 2: 记录观察数据 (Record Observations) 针对所有 `status: OBSERVING` 并且还没到期的实验： - 读取该实验在 `state.json` 中的 `telemetry_hook` 字段。严格执行 `command` 定义的命令收集原始日志。 - **降噪防护**：如果本次 Tick 没有任何实质性指标变化或未收集到新的反馈，**直接跳过，切勿写入全空的假日志**。只有捕获到了新指标才追加到对应的 `memory/evolve/[cycle_id].jsonl`。 - **强制输出**：生成的 JSONL 记录的 `metrics` 字典中，必须强制包含并输出 `extract` 要求的所有监控项键，防范糊弄。 - **极端拦截**：若收集数据时发现极端负向反应（如系统连续崩溃），触发提前终止，强制进入下一步的评估流。Technical Analysis
The protocol instructs the Agent to read
telemetry_hook.commandfrom the mutablememory/evolve/state.jsonfile and execute that command exactly. It does not require command allowlisting, argument validation, shell-metacharacter filtering, privilege reduction, sandboxing, or human approval.This creates a command-injection boundary: configuration data is treated as executable shell input. If an attacker, compromised skill, poisoned experiment, or another process can modify the state file, it can replace the telemetry command with an arbitrary command. The next self-evolve tick would then execute it with the privileges available to the Agent.
Attack Path
- The attacker obtains direct or indirect write access to
memory/evolve/state.json, such as through a poisoned experiment registration or another writable Agent workflow. - The attacker creates an experiment with
status: OBSERVING. - The attacker sets
telemetry_hook.commandto a malicious shell command. - A scheduled or manually triggered self-evolve tick reaches the observation step.
- The Agent follows the protocol and executes the attacker-controlled command.
- The command accesses files, modifies configuration, executes programs, or performs network operations within the Agent process's permissions.
...[truncated 521 chars]
- The attacker obtains direct or indirect write access to
- Remediation
View remediation
Remediation Suggestions
- Remove support for arbitrary shell strings in
telemetry_hook.command. - Replace commands with identifiers for predefined telemetry adapters, such as
collect_error_countorcollect_latency. - Store arguments as structured arrays and invoke processes without a shell.
- Apply strict allowlists to executable paths, arguments, readable files, and output formats.
- Reject shell metacharacters, command substitution, redirection, pipes, and newline characters.
- Run telemetry collectors in a restricted sandbox with minimal filesystem and network access.
- Validate the ownership, permissions, schema, and integrity of
state.jsonbefore use. - Require explicit human approval before any newly registered telemetry collector is executed.
- Record the exact approved collector and arguments in an append-only audit log.
- Remove support for arbitrary shell strings in