T09 · Insecure Skill Coding Practices
Error
- Location
skills/hosted-agents/references/infrastructure-patterns.md:40- Finding
Shell Command Injection and GitHub Token Exposure in Hosted-Agent Infrastructure
- Content
View full analysis
dict: """Execute a prompt in the sandbox.""" # Update git config for this user os.system(f'git config user.name "{user_identity["name"]}"') os.system(f'git config user.email "{user_identity["email"]}"') ``` The image-building example repeats the unsafe construction: ```python token = get_app_installation_token(repo) sandbox.exec(f"git clone https://x-access-token:{token}@github.com/{repo} /workspace") # Install dependencies sandbox.exec("cd /workspace && npm install") # Run build sandbox.exec("cd /workspace && npm run build") ``` The executable template uses the same command-string design: ```python build_steps: list[str] = [ f"git clone https://x-access-token:{token}@github.com/{repo_url} /workspace", "cd /workspace && npm install", "cd /workspace && npm run build", "cd /workspace && npm run dev &", "sleep 5", "cd /workspace && npm test -- --run || true", ] ``` ```python await sandbox.execute_command( f'git config user.name "{user.name}"' ) await sandbox.execute_command( f'git config user.email "{user.email}"' ) ``` ### Technical Analysis Repository identifiers and user profile fields are interpolated directly into shell command strings. The reference implementation explicitly passes these strings to `os.system`, which always invokes a command shell. Shell metacharacters embedded in `repo_url`, `repo`, `user_identity["name"]`, or `user_identi ...[truncated 2882 chars]- Remediation
View remediation