T09 · Insecure Skill Coding Practices
Error
- Location
scripts/subagent_orchestrator.py:247- Finding
Arbitrary Python Code Execution Through Untrusted Workflow Configuration
- Content
View full analysis
bool: """Evaluate a condition expression.""" try: if condition == "user_confirmed == true": return self.context.get("user_confirmed", False) is True elif condition == "is_valid == true": return self.context.get("is_valid", False) is True else: local_vars = {**self.context} for task_id, result in self.results.items(): local_vars.update(result.outputs) return eval(condition, {}, local_vars) except Exception as e: logger.warning(f"Failed to evaluate condition '{condition}': {e}") return False ``` ### Technical Analysis `SubagentOrchestrator` accepts a configurable workflow file and uses values from that file to control two executable Python mechanisms: 1. Agent module and class names are passed to `importlib.import_module()` and `getattr()`. 2. Workflow condition strings are passed directly to Python's `eval()`. Passing an empty dictionary as the globals argument to `eval()` does not reliably create a secure sandbox. Python can populate built-ins, allowing a malicious expression to access functions such as `__import__` and then invoke operating-system or file APIs. Context objects and task outputs also become available as local variables, increasing the available attack surface. The dynamic import path independently permits execution of module-level code when a configuration identifies an attacker-controlled impo ...[truncated 1563 chars]- Remediation
View remediation