T09 · Insecure Skill Coding Practices
Error
- Location
wotohub_skill.py:146- Finding
Request-Controlled Arbitrary Command Execution with Inherited Credentials
- Content
View full analysis
tuple[dict, Optional[dict]]: request = _extract_host_url_analysis_request(orchestrated) if not request: return req, None config = req.get("config", {}) or {} executor = None if hasattr(orchestrator, "_get_host_analysis_executor"): executor = orchestrator._get_host_analysis_executor(config=config) if not executor: return req, { "status": "no_executor_configured", "request": request, } payload = orchestrator._run_host_analysis_executor(request=request, executor_spec=executor) ``` ```python # scripts/orchestrator.py:509-570 def _get_host_analysis_executor(self, *, config: dict[str, Any]) -> Any: for key in ("hostAnalysisExecutor", "host_analysis_executor", "hostSemanticExecutor", "host_semantic_executor"): if config.get(key): return config.get(key) env_default = os.environ.get("WOTOHUB_HOST_ANALYSIS_EXECUTOR") or os.environ.get("HOST_ANALYSIS_EXECUTOR") if env_default: return env_default return None def _run_host_analysis_executor(self, *, request: dict[str, Any], executor_spec: Any) -> Any: skill_root = Path(__file__).resolve().parent.parent with tempfile.TemporaryDirectory(prefix="wotohub-host-analysis-") as tmp: tmp_dir = Path(tmp) input_path = tmp_dir / "host-analysis-request.json" output_path = tmp_dir / "host-analysis-output.json" input_path.write_text(json.dumps(request, ensure_ascii=False, indent=2), encoding="utf-8") timeout_seconds = 180 cwd = str(skill_root) env_o ...[truncated 4131 chars]- Remediation
View remediation