T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run-code.cjs:135- Finding
Arbitrary User-Supplied Code Executes Directly on the Host Without Isolation
- Content
View full analysis
{ const startTime = Date.now(); const child = exec(command, { timeout: timeout, maxBuffer: 10 * 1024 * 1024, // 10MB buffer encoding: 'utf8' }, (error, stdout, stderr) => { const duration = Date.now() - startTime; if (error) { if (error.killed) { reject({ error: 'Execution timed out', duration, stderr: stderr || '' }); } else { reject({ error: error.message, duration, stderr: stderr || '', code: error.code }); } return; } resolve({ stdout: stdout || '', stderr: stderr || '', duration }); }); }); } ``` The user-controlled code is subsequently written to a file and executed: ```js // Handle interpreted languages tempFile = createTempFile(code, config.ext); const command = `${config.executor} "${tempFile}"`; return await executeCommand(command, timeout); ``` The supported executors include direct operating-system scripting facilities: ```js shellscript: { executor: 'bash', ext: 'sh' }, bash: { executor: 'bash', ext: 'sh' }, powershell: { executor: process.platform === 'win32' ? 'powershell -ExecutionPolicy ByPass -File' : 'pwsh -File', ext: 'ps1' }, bat: { executor: 'cmd /c', ext: 'bat' }, cmd ...[truncated 2539 chars]- Remediation
View remediation