T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:229- Finding
Arbitrary Shell Execution Through Credential-File Sourcing
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:229-235
Vulnerability Type: Unsafe shell evaluation of a user-supplied credential file
Risk Level: HighVulnerable code:
markdown #### 8.1 Prepare Environment If the user provided a credential file path (e.g., `env.sh`), source it: ```bash source <credential-file-path>Verify access by running a simple describe command against the target service and region.
text ### Technical Analysis The `source` shell built-in executes a file in the current shell process. It does not distinguish environment-variable declarations from arbitrary shell commands. Consequently, a file presented as an AWS credential file can contain command substitutions, function calls, filesystem operations, network commands, or other executable statements. The instructions do not require the Agent to validate the path, inspect the file, restrict its syntax, obtain confirmation after displaying its contents, or isolate its execution. Because execution occurs in the current process, the file can also modify shell options, command lookup behavior, environment variables, and subsequent AWS CLI execution. ### Attack Path 1. An attacker creates or modifies a file represented as an AWS credential file. 2. The file contains legitimate-looking AWS environment declarations followed by arbitrary shell commands. 3. The attacker persuades a user to provide that file path for a live assessment, or places the file at a path the user already trusts. 4. The Agent follows Step 8.1 and runs `source <credential-file-path>`. 5. All statements in the file execute with the OS permissions of the Agent process. 6. The malicious statements can access local files, alter the assessment environment, invoke external programs, or interfere with later AWS CLI operations. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the account ...[truncated 337 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the instruction to execute credential files with
source. - Prefer an AWS profile name supplied through
--profile, or credentials already configured in the process environment. - If a file must be supported, parse it as data rather than shell code. Permit only a strict allowlist such as
AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_SESSION_TOKEN,AWS_PROFILE, andAWS_REGION. - Reject command substitutions, shell metacharacters, functions, redirects, and any unrecognized keys.
- Read credentials into a dedicated child-process environment instead of modifying the Agent's current shell.
- Verify file ownership and restrictive permissions before reading it.
- Never print secret values in command output or generated reports.
- Require explicit user confirmation after identifying the exact file and before importing any credential material.
- Remove the instruction to execute credential files with