T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:91- Finding
User-Controlled Spec Filename Enables Python Code Injection
- Content
View full analysis
&1 && echo "✅ YAML syntax valid" || echo "❌ YAML syntax error" elif [[ "$SPEC_FILE" == *.json ]]; then python3 -c "import json,sys; json.load(open('$SPEC_FILE'))" 2>&1 && echo "✅ JSON syntax valid" || echo "❌ JSON syntax error" fi python3 -c " import yaml, json, sys try: with open('$SPEC_FILE') as f: spec = yaml.safe_load(f) if '$SPEC_FILE'.endswith(('.yaml','.yml')) else json.load(f) ``` The same unsafe construction is repeated when generating endpoint inventories and test commands: ```bash python3 -c " import yaml, json, sys spec_file = '$SPEC_FILE' with open(spec_file) as f: ``` ```bash python3 -c " import yaml, json spec_file = '$SPEC_FILE' with open(spec_file) as f: ``` ### Technical Analysis The user-provided `SPEC_FILE` value is interpolated directly into Python source passed to `python3 -c`. Shell quoting does not make the resulting Python string safe. A filename containing a single quote can terminate the Python string literal and introduce additional Python statements. Because Python provides direct access to operating-system functionality, successful injection can invoke commands, read files, alter project content, or perform network operations with the privileges of the user running the Skill. This exceeds the minimum privileges needed to parse an OpenAPI document. The file path should be treated strictly as data and passed through an argument or environment variable rather than incorporated into executable source. ### Attack Path 1. An attacker creates or supplies an OpenAPI file with a specially crafted fi ...[truncated 1054 chars]- Remediation
View remediation