T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.sh:38- Finding
Python Code Injection Through an Attacker-Controlled Installation Path
- Content
View full analysis
/dev/null || echo "") TARGET=$(python3 -c "import json; print(json.load(open('$CONFIG'))['target_language'])" 2>/dev/null || echo "") LEVEL=$(python3 -c "import json; print(json.load(open('$CONFIG'))['current_level'])" 2>/dev/null || echo "") ``` The same unsafe pattern also appears when optional configuration fields are read at lines 63–69. ### Technical Analysis The script places the value of `$CONFIG` directly inside Python source code passed to `python3 -c`. Although the shell expands the variable inside a double-quoted argument, the resulting path is enclosed only by Python single quotes. A single quote and valid Python syntax in the Skill installation path can therefore terminate the Python string and introduce additional statements. Shell quoting does not prevent this issue because the injection occurs when Python parses the already-expanded source string, not while the shell parses the command. An attacker who controls the directory in which the project is placed could use a path component conceptually shaped like: ```text x')));__import__('os').system('ATTACKER_COMMAND');# ``` When incorporated into the generated Python source, this can close the `open`, `json.load`, and `print` calls, execute an injected statement, and comment out the remainder of the source line. Exploitation requires the victim to run `scripts/setup.sh` from an attacker-crafted installation path. The ordinary documented installation path does not contain the necessary characters, but the script neither validates nor safely passes its location. ### Attack Path 1. An attacker creates or distributes the Skill inside a directory whose name contains a single ...[truncated 1054 chars]- Remediation
View remediation