T09 · Insecure Skill Coding Practices
Error
- Location
- runner/run_task.sh:232
- Finding
- Unrestricted Remote Shell Command Execution Through the Exec Task<![CDATA[ ## Vulnerability Details **File Location**: `runner/run_task.sh`, lines 232-243 and 562-564 **Vulnerability Type**: Arbitrary command execution without authorization or confinement **Risk Level**: Critical ### Vulnerable Code ```bash run_exec() { local cmd="$1" if [ -z "$cmd" ]; then echo "ERROR: no command provided" exit 1 fi if [ "$DRY_RUN" = true ]; then echo "DRY RUN: would run shell command" echo "Command: $cmd" return 0 fi eval "$cmd" } ``` The task dispatcher exposes the function directly: ```bash exec) CMD="${*}" run_exec "$CMD" ;; ``` The Python entry point sends user-controlled task arguments to this runner over SSH: ```python def run_task(self, task_command: str) -> str: """Run a task on the worker Mac with exclusivity locking.""" with self.lock: cmd = [f"{self.runner_path}/run_task.sh", *shlex.split(task_command)] stdout, stderr, code = self._ssh(cmd) ``` ### Technical Analysis The `exec` task intentionally accepts an arbitrary command string and evaluates it with Bash `eval`. The implementation has no command allowlist, authorization check, confirmation requirement, working-directory restriction, sandbox, or project-level confinement. Although remote command execution is documented as an available feature, it exceeds the privileges required for the Skill's primary queue-management, code-generation, controlled file-writing, and test-running functions. Any caller that can cause the Skill to process an `ollama run exec` request effectively obtains a shell under the SSH worker account. Using `eval` also causes shell syntax in the supplied value to be interpreted, including command substitutions, redirections, pipelines, variable expansion, and command separators. Quoting performed by the Python SSH layer does not make this safe because the runner deliberately re-evaluates the reconstructed string. ### Attack Path 1. An attacker supplies or induces an Agent to pro ...[truncated 1047 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `exec` task unless unrestricted shell access is an essential and explicitly approved requirement. 2. Replace arbitrary commands with narrowly scoped, structured operations such as fixed test, build, lint, and status subcommands. 3. If command execution must remain available: - Disable it by default through an administrator-controlled setting. - Add caller authentication and per-action authorization. - Require an explicit human confirmation for dangerous operations. - Use a strict executable and argument allowlist. - Invoke commands through argument arrays rather than `eval` or `bash -c`. - Run commands in a dedicated, minimally privileged service account or sandbox. - Restrict filesystem and network access to the required project resources. 4. Ensure untrusted natural-language content cannot select the direct `exec` action. 5. Add audit logging that records the authenticated caller, exact executable and arguments, time, working directory, and result. ]]>