T09 · Insecure Skill Coding Practices
- Location
references/tool-builder.md:253- Finding
Agent-Controlled Expressions Are Executed with Python eval()
- Content
View full analysis
Vulnerability Details
File Location:
references/tool-builder.md:253-260andreferences/tool-builder.md:362-369
Vulnerability Type: Arbitrary Python code execution through unsafe expression evaluation
Risk Level: HighVulnerable Code
python def handle_tool(call): if call.name == "greet": result = f"Hello, {call.args['name']}!" elif call.name == "calculate": result = eval(call.args['expression']) else: result = {"error": f"Unknown tool: {call.name}"} agent.submit_tool_result(call.id, result)The complete example repeats the same unsafe pattern:
python def handle_tool(call): if call.name == "calculate": try: result = eval(call.args["expression"]) agent.submit_tool_result(call.id, {"result": result}) except Exception as e: agent.submit_tool_result(call.id, {"error": str(e)})Technical Analysis
The calculator tool passes an agent-generated string directly to Python's
eval(). Tool arguments can be influenced by user messages, retrieved content, or indirect prompt injection.eval()does not restrict input to arithmetic: it can resolve Python names, invoke functions, import modules through built-ins, and interact with the local environment.Exception handling in the second example does not establish a security boundary. It only reports failures after the expression has already been evaluated. The calculator tool also does not require human approval in the complete example.
Although this code appears in documentation rather than an automatically executed script, users who copy the documented handler would create an arbitrary-code-execution vulnerability in the host application.
Attack Path
- An attacker sends a malicious message to an application using the documented calculator tool, or places malicious instructions in content consumed by the agent.
- The ...[truncated 887 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove every use of
eval()for agent- or user-controlled expressions. - Use a dedicated arithmetic parser or an allowlisted Abstract Syntax Tree evaluator.
- If using
ast.parse, permit only numeric constants and explicitly approved arithmetic operators. Reject calls, names, attributes, comprehensions, subscriptions, imports, and assignments. - Enforce expression length, numeric magnitude, recursion-depth, and execution-time limits to prevent denial of service.
- Validate tool arguments independently of the model and return a structured validation error for unsupported syntax.
- Consider requiring approval for high-impact client tools, but do not treat approval as a substitute for safe parsing.
- Run tool handlers in a restricted process with minimal filesystem, environment, and network access.
- Remove every use of