T09 · Insecure Skill Coding Practices
Error
- Location
scripts/health-check.sh:243- Finding
Arbitrary Command Execution Through Configuration-Driven Shell Evaluation
- Content
View full analysis
/dev/null 2>&1; then record_metric "$name" "up" "0" $QUIET || echo "[OK] $name — process running" log "CHECK OK: $name — running" return 0 else record_metric "$name" "down" "0" echo "[FAIL] $name — process not running" log "CHECK FAIL: $name — not running" # Auto-restart if configured if [ -n "$restart_cmd" ]; then log "RESTART: Attempting $name via: $restart_cmd" if eval "$restart_cmd" 2>/dev/null; then sleep 3 if pgrep -f "$process_name" > /dev/null 2>&1; then record_metric "$name" "recovered" "0" echo "[RECOVERED] $name — restarted successfully" log "RESTART OK: $name recovered" return 0 fi fi log "RESTART FAIL: $name did not recover" fi return 1 fi } ``` ```bash # Read config and run checks via Python (handles JSON parsing) eval "$(python3 -c " import json config = json.load(open('$CONFIG')) for svc in config.get('services', []): name = svc['name'].replace(\"'\", \"\") stype = svc.get('type', 'url') if stype == 'url': target = svc['target'] expected = svc.get('expected_status', 200) timeout = svc.get('timeout_seconds', 10) print(f\"check_url '{name}' '{target}' '{expected}' '{timeout}'\") elif stype == 'port': host = svc.get('host', '127.0.0.1') port = svc['port'] timeout = svc.get('timeout_seconds', 3) print(f\"check_port '{name}' '{host}' '{port}' '{timeout}'\") elif stype == 'process': proc = svc['process_name'] restart = svc.get('restart_command', '') print(f\"ch ...[truncated 3711 chars]- Remediation
View remediation