T09 · Insecure Skill Coding Practices
Error
- Location
scripts/draft-post.sh:69- Finding
Arbitrary Python Code Execution Through Draft Post Text
- Content
View full analysis
"$DRAFTS_DIR/$POST_ID.json" << EOF { "id": "$POST_ID", "platforms": $PLATFORMS_JSON, "text": $(python3 -c "import json; print(json.dumps('''$TEXT'''))"), "media": $MEDIA_JSON, "scheduled_at": $SCHEDULE_JSON, "status": "draft", "created_at": "$NOW", "approved": false, "tags": $TAGS_JSON, "thread": $THREAD } EOF ``` ### Technical Analysis The value supplied through `--text` is interpolated directly into Python source code inside a triple-quoted string. Shell quoting does not make the resulting Python program safe. An attacker who can influence the post text can insert a triple-quote terminator and additional Python statements. When `draft-post.sh` invokes `python3 -c`, the injected statements execute with the same operating-system privileges and environment as the user running the skill. This is not limited to corrupting the generated JSON. Injected Python can invoke system commands, read or modify files accessible to the current user, inspect environment variables containing social-media tokens, or establish additional network connections. ### Attack Path 1. An attacker supplies or causes the agent to use malicious content as the `--text` value. 2. The content closes the `'''...'''` Python string used by the script. 3. The content appends valid Python statements and comments out the remaining generated source. 4. `python3 -c` parses the attacker-controlled statements as executable code. 5. The payload runs with the privileges and environment of the skill process. A conceptual payload has the following structure: ```text '''); ATTACKER_CONTROLLED_PYTHON; # ``` ### Impact Assessment Successful exploitation provides arbitrary local code execution as the account running the skill. The attacker could: - Read or alter files available to that acc ...[truncated 414 chars]- Remediation
View remediation