T09 · Insecure Skill Coding Practices
- Location
scripts/run_trigger_eval.py:163- Finding
Trigger Evaluation Exposes the Host Environment and Project to External Agent CLIs
- Content
View full analysis
Vulnerability Details
File Location:
scripts/run_trigger_eval.py, lines 163-168
Vulnerability Type: Excessive environment and filesystem privileges in child processes
Risk Level: HighVulnerable Code
python env = {k: v for k, v in os.environ.items() if k != "CLAUDECODE"} process = subprocess.Popen( cmd, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, cwd=str(project_root), env=env, )The other live adapters also launch agent CLIs from the detected project root while implicitly inheriting the complete parent environment:
python result = subprocess.run( cmd, capture_output=True, text=True, timeout=timeout, cwd=str(project_root), )This pattern occurs in the Codex adapter at lines 363-367 and the OpenClaw adapter at lines 412-415.
Technical Analysis
The Claude adapter forwards every host environment variable except
CLAUDECODE. The inherited values may include API keys, cloud credentials, access tokens, proxy credentials, and other secrets. The Codex and OpenClaw adapters do not provide an explicit environment, so they inherit the entire parent environment by default.These agent CLIs also execute with
cwdset to the detected real project root. Consequently, they may access project files, platform-specific instructions, and other data available under the invoking user's permissions. The trigger evaluator does not enforce a disposable workspace, restricted tool set, clean environment, network isolation, or approval mode.This exceeds least privilege for trigger testing, which only needs to determine whether the temporary probe is activated. It is also inconsistent with the stronger safety boundary in
agents/executor.md, which requires disposable workspaces, mocked dependencies, approval for mutations, and restrictions on high-impact tools when testing untrusted skills.The subprocess calls use argument arrays and do not use
shell=True; therefor ...[truncated 1963 chars]- Remediation
View remediation
Remediation Suggestions
- Run every trigger probe in a newly created disposable directory containing only the generated probe and required minimal platform configuration.
- Replace environment inheritance with an explicit allowlist. Pass only variables essential for process startup and the selected provider, such as a controlled
PATH, a temporaryHOME, locale settings, and at most the single required authentication credential. - Use a temporary home/configuration directory so platform CLIs cannot load unrelated user-level rules, plugins, credentials, or persistent state.
- Disable network access, mutating tools, shell execution, and unrestricted file access wherever the target platform supports such controls.
- Require explicit user approval before running a live probe when the selected adapter cannot guarantee isolation.
- Apply the mandatory safety boundary from
agents/executor.mdto Phase 1.5 trigger evaluation as well. - Do not automatically execute from an ancestor project directory. Require an explicit project root, validate it, and copy only required files into the disposable workspace.
- Document which credentials and external services each adapter requires before execution.
- Capture and report attempted tool calls and side effects rather than recording only whether the probe activated.
- Add regression tests verifying that unrelated environment variables and host-project files are unavailable to probe subprocesses.