T09 · Insecure Skill Coding Practices
Error
- Location
- references/tool-builder.md:253
- Finding
- Agent-Controlled Expressions Are Executed with Python eval()## Vulnerability Details **File Location**: `references/tool-builder.md:253-260` and `references/tool-builder.md:362-369` **Vulnerability Type**: Arbitrary Python code execution through unsafe expression evaluation **Risk Level**: High ### Vulnerable Code ```python def handle_tool(call): if call.name == "greet": result = f"Hello, {call.args['name']}!" elif call.name == "calculate": result = eval(call.args['expression']) else: result = {"error": f"Unknown tool: {call.name}"} agent.submit_tool_result(call.id, result) ``` The complete example repeats the same unsafe pattern: ```python def handle_tool(call): if call.name == "calculate": try: result = eval(call.args["expression"]) agent.submit_tool_result(call.id, {"result": result}) except Exception as e: agent.submit_tool_result(call.id, {"error": str(e)}) ``` ### Technical Analysis The calculator tool passes an agent-generated string directly to Python's `eval()`. Tool arguments can be influenced by user messages, retrieved content, or indirect prompt injection. `eval()` does not restrict input to arithmetic: it can resolve Python names, invoke functions, import modules through built-ins, and interact with the local environment. Exception handling in the second example does not establish a security boundary. It only reports failures after the expression has already been evaluated. The calculator tool also does not require human approval in the complete example. Although this code appears in documentation rather than an automatically executed script, users who copy the documented handler would create an arbitrary-code-execution vulnerability in the host application. ### Attack Path 1. An attacker sends a malicious message to an application using the documented calculator tool, or places malicious instructions in content consumed by the agent. 2. The ...[truncated 887 chars]
- Remediation
- ## Remediation Suggestions - Remove every use of `eval()` for agent- or user-controlled expressions. - Use a dedicated arithmetic parser or an allowlisted Abstract Syntax Tree evaluator. - If using `ast.parse`, permit only numeric constants and explicitly approved arithmetic operators. Reject calls, names, attributes, comprehensions, subscriptions, imports, and assignments. - Enforce expression length, numeric magnitude, recursion-depth, and execution-time limits to prevent denial of service. - Validate tool arguments independently of the model and return a structured validation error for unsupported syntax. - Consider requiring approval for high-impact client tools, but do not treat approval as a substitute for safe parsing. - Run tool handlers in a restricted process with minimal filesystem, environment, and network access.