T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run-code.cjs:135
- Finding
- Arbitrary User-Supplied Code Executes Directly on the Host Without Isolation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run-code.cjs:135-166, 196-247`; related documentation at `SKILL.md:162-171` **Vulnerability Type**: Unsandboxed arbitrary code execution **Risk Level**: High ### Vulnerable Code ```js function executeCommand(command, timeout = DEFAULT_TIMEOUT) { return new Promise((resolve, reject) => { const startTime = Date.now(); const child = exec(command, { timeout: timeout, maxBuffer: 10 * 1024 * 1024, // 10MB buffer encoding: 'utf8' }, (error, stdout, stderr) => { const duration = Date.now() - startTime; if (error) { if (error.killed) { reject({ error: 'Execution timed out', duration, stderr: stderr || '' }); } else { reject({ error: error.message, duration, stderr: stderr || '', code: error.code }); } return; } resolve({ stdout: stdout || '', stderr: stderr || '', duration }); }); }); } ``` The user-controlled code is subsequently written to a file and executed: ```js // Handle interpreted languages tempFile = createTempFile(code, config.ext); const command = `${config.executor} "${tempFile}"`; return await executeCommand(command, timeout); ``` The supported executors include direct operating-system scripting facilities: ```js shellscript: { executor: 'bash', ext: 'sh' }, bash: { executor: 'bash', ext: 'sh' }, powershell: { executor: process.platform === 'win32' ? 'powershell -ExecutionPolicy ByPass -File' : 'pwsh -File', ext: 'ps1' }, bat: { executor: 'cmd /c', ext: 'bat' }, cmd ...[truncated 2539 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Run every snippet inside a new ephemeral container or equivalent operating-system sandbox. 2. Use a dedicated unprivileged account with no access to the host workspace, home directory, credentials, or service sockets. 3. Mount only a newly created working directory and make the container root filesystem read-only. 4. Disable outbound and inbound network access by default. Enable narrowly scoped network access only through explicit policy. 5. Remove inherited secrets and pass a minimal allowlisted environment to the sandbox. 6. Apply strict CPU, memory, file-size, process-count, and execution-time limits. 7. Drop Linux capabilities, enable `no-new-privileges`, and apply syscall filtering such as seccomp where supported. 8. Terminate the complete process group or container when execution finishes or times out, rather than killing only the immediate shell. 9. Require explicit user confirmation before executing shell, PowerShell, Batch, AppleScript, AutoHotkey, or other system-oriented languages. 10. Refuse to execute untrusted code when an approved isolation mechanism is unavailable. ]]>