T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/maxun.sh:43
- Finding
- Arbitrary Python Code Execution Through Unsafe Limit Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/maxun.sh`, lines 43–47 **Vulnerability Type**: Python code injection caused by unsafe interpolation **Risk Level**: High ### Vulnerable Code ```bash list) LIMIT="${2:-}" _get "/api/sdk/robots" | python3 -c " import json, sys raw = '${LIMIT}' limit = int(raw) if raw.isdigit() else None ``` ### Technical Analysis The second command-line argument is inserted directly into source code passed to `python3 -c`. Shell quoting does not make this safe because the interpolation occurs inside a Python string literal. An argument containing a single quote can terminate that literal and introduce arbitrary Python statements. Although `SKILL.md` directs the agent to invoke exactly `maxun list`, the packaged script itself accepts a second argument. The vulnerability remains reachable by direct invocation, by another caller using the helper, or if the agent’s command-generation restrictions are bypassed. For example, a value constructed to close `raw = '...'`, execute Python code, and comment out the remainder could invoke `os.system`, `subprocess`, or Python file and network APIs. The injected Python process runs with the same user identity and environment as the Skill. ### Attack Path 1. The attacker obtains influence over the second argument passed to `maxun.sh list`, either through direct invocation or compromised command construction. 2. The attacker supplies an argument containing a single quote and additional Python syntax. 3. Bash substitutes that value into the multiline `python3 -c` program. 4. The injected syntax escapes the intended `raw` string literal. 5. Python executes the attacker-controlled statements with the Skill process’s privileges. ### Impact Assessment Successful exploitation permits arbitrary local code execution. The attacker could read or modify files available to the gateway user, access environment variables such as `MAXUN_API_KEY`, issue network requests, invoke other prog ...[truncated 176 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Never interpolate an argument into dynamically generated Python source. Pass the value as a normal process argument and read it through `sys.argv`: ```bash LIMIT="${2:-}" _get "/api/sdk/robots" | python3 -c ' import json import sys raw = sys.argv[1] limit = int(raw) if raw.isdigit() else None data = json.load(sys.stdin) # Continue processing data here. ' "$LIMIT" ``` Also enforce an explicit shell-side validation rule before invoking Python: ```bash if [[ -n "$LIMIT" && ! "$LIMIT" =~ ^[0-9]+$ ]]; then echo '{"error":"limit must be a positive integer"}' >&2 exit 2 fi ``` Restrict the execution policy to the documented commands and argument formats instead of relying only on instructions in `SKILL.md`. ]]>