T09 · Insecure Skill Coding Practices
- Location
scripts/configure_model.py:27- Finding
PowerShell Command Injection Through Unescaped Configuration Values
- Content
View full analysis
Vulnerability Details
File Location:
scripts/configure_model.py, lines 27-35
Vulnerability Type: PowerShell command injection
Risk Level: Highpython commands = [ f'[Environment]::SetEnvironmentVariable("ANTHROPIC_API_KEY", "{api_key}", "User")', f'[Environment]::SetEnvironmentVariable("ANTHROPIC_BASE_URL", "{base_url}", "User")', f'[Environment]::SetEnvironmentVariable("ANTHROPIC_MODEL", "{model}", "User")', '[Environment]::SetEnvironmentVariable("ANTHROPIC_AUTH_TOKEN", "", "User")', ] for cmd in commands: subprocess.run(["powershell", "-Command", cmd], check=True)Technical Analysis
The
api_key,base_url, andmodelcommand-line arguments are interpolated directly into PowerShell source code. The resulting string is then passed topowershell -Command, causing PowerShell to parse attacker-controlled data as executable language syntax.Although
subprocess.runuses an argument array, this does not prevent injection because the unsafe interpretation occurs inside PowerShell's-Commandargument. An attacker can include quotation marks and PowerShell separators or expressions in any interpolated value, terminate the expected string literal, and append arbitrary PowerShell commands.Attack Path
- An attacker supplies a malicious API key, endpoint, or model value, or persuades a user to copy a crafted provider configuration command.
- The user runs the script on Windows without the
--skip-envoption. - The script inserts the malicious value into a PowerShell command string without escaping it.
powershell -Commandparses the injected syntax.- The attacker's appended command executes with the privileges of the user running the script.
Impact Assessment
Successful exploitation provides arbitrary command execution under the current user's security context. An attacker could read or modify user-accessible files, steal credentials, alter Cla ...[truncated 347 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not construct PowerShell source code by interpolating user-controlled values.
- Prefer a native Python mechanism for persistent Windows environment variables, such as writing validated string values through the appropriate
winreguser-environment registry interface. - If PowerShell must be used, invoke a fixed script whose code is not dynamically generated and transfer values through a non-code data channel. Do not concatenate values into the
-Commandexpression. - Validate
base_urlwith a strict URL parser and permit only expected secure schemes such as HTTPS. - Validate the model name against the provider's documented character set and reject control characters, line breaks, quotation marks, and shell metacharacters as defense in depth.
- Add automated Windows tests containing quotation marks, semicolons, command substitutions, and line breaks to verify that inputs are always handled strictly as data.