T09 · Insecure Skill Coding Practices
Error
- Location
scripts/rehash.sh:26- Finding
Integrity Verification Fails to Detect Unlisted or Non-Shell Dependency Files
- Content
View full analysis
&2 continue fi while IFS= read -r -d '' script; do rel_path="${script#"$SKILLS_DIR/"}" hash="$(sha256sum "$script" | awk '{print $1}')" echo "$hash $rel_path" >> "$CHECKSUMS" ((count++)) done < <(find "$script_dir" -type f -name '*.sh' -print0 | sort -z) done ``` The resulting manifest is verified as follows: ```bash while IFS= read -r line; do # skip comments and empty lines [[ "$line" =~ ^[[:space:]]*# ]] && continue [[ -z "${line// }" ]] && continue local expected_hash file_rel expected_hash="$(echo "$line" | awk '{print $1}')" file_rel="$(echo "$line" | awk '{print $2}')" local file_abs="$SKILLS_DIR/$file_rel" if [[ ! -f "$file_abs" ]]; then echo " MISSING: $file_rel" >&2 ((failed++)) continue fi local actual_hash actual_hash="$(sha256sum "$file_abs" | awk '{print $1}')" if [[ "$actual_hash" != "$expected_hash" ]]; then echo " MISMATCH: $file_rel" >&2 echo " expected: $expected_hash" >&2 echo " actual: $actual_hash" >&2 ((failed++)) else echo " OK: $file_rel" fi done < "$CHECKSUMS" ``` ### Technical Analysis The baseline-generation process includes only files ending in `.sh`. It does not cover Python, JavaScript, service definitions, configuration files, or other payloads that a downstream deployment script may execute, install, or copy. The generator also silently skips a dependency whose `scripts` directory is absent. The verifier only checks entries already present in the manifest; it does not compare the manifest against an authoritative list ...[truncated 1430 chars]- Remediation
View remediation