T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/draft-post.sh:69
- Finding
- Arbitrary Python Code Execution Through Draft Post Text<![CDATA[ ## Vulnerability Details **File Location**: `scripts/draft-post.sh`, line 69 **Vulnerability Type**: Python source-code injection **Risk Level**: High ### Vulnerable Code ```bash cat > "$DRAFTS_DIR/$POST_ID.json" << EOF { "id": "$POST_ID", "platforms": $PLATFORMS_JSON, "text": $(python3 -c "import json; print(json.dumps('''$TEXT'''))"), "media": $MEDIA_JSON, "scheduled_at": $SCHEDULE_JSON, "status": "draft", "created_at": "$NOW", "approved": false, "tags": $TAGS_JSON, "thread": $THREAD } EOF ``` ### Technical Analysis The value supplied through `--text` is interpolated directly into Python source code inside a triple-quoted string. Shell quoting does not make the resulting Python program safe. An attacker who can influence the post text can insert a triple-quote terminator and additional Python statements. When `draft-post.sh` invokes `python3 -c`, the injected statements execute with the same operating-system privileges and environment as the user running the skill. This is not limited to corrupting the generated JSON. Injected Python can invoke system commands, read or modify files accessible to the current user, inspect environment variables containing social-media tokens, or establish additional network connections. ### Attack Path 1. An attacker supplies or causes the agent to use malicious content as the `--text` value. 2. The content closes the `'''...'''` Python string used by the script. 3. The content appends valid Python statements and comments out the remaining generated source. 4. `python3 -c` parses the attacker-controlled statements as executable code. 5. The payload runs with the privileges and environment of the skill process. A conceptual payload has the following structure: ```text '''); ATTACKER_CONTROLLED_PYTHON; # ``` ### Impact Assessment Successful exploitation provides arbitrary local code execution as the account running the skill. The attacker could: - Read or alter files available to that acc ...[truncated 414 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Never interpolate post content into executable Python source. Pass it as a positional argument or through standard input: ```bash TEXT_JSON=$(python3 -c 'import json, sys; print(json.dumps(sys.argv[1]))' "$TEXT") ``` Then use the encoded result when generating the document: ```bash "text": $TEXT_JSON, ``` A stronger design is to construct the entire post document in one Python program and pass every external value through `sys.argv`, environment variables, or standard input. Alternatively, use `jq --arg` to create the JSON object. Add regression tests containing: - Triple quotes. - Single and double quotes. - Newlines and backslashes. - Shell metacharacters. - Text resembling Python statements. The tests should verify that all such values are stored literally and never executed. ]]>