T09 · Insecure Skill Coding Practices
Error
- Location
scripts/check_sandbox.py:20- Finding
Incomplete sandbox validation permits prohibited capability access through whitelisted modules
- Content
View full analysis
Vulnerability Details
File Location:
scripts/check_sandbox.py, lines 20–24 and 54–137
Vulnerability Type: Incomplete security-policy enforcement
Risk Level: HighVulnerable Code
python IMPORT_WHITELIST = { "asyncio", "collections", "csv", "dataclasses", "datetime", "decimal", "enum", "fractions", "functools", "itertools", "json", "math", "re", "statistics", "string", "time", "typing", "uuid", } FORBIDDEN_FUNCS = [ "eval", "exec", "compile", "__import__", "getattr", "setattr", "hasattr", "delattr", "globals", "locals", "vars", ]python def check(source: str) -> list[dict]: """Return list of {rule_id, line, message, fix} violations.""" violations = [] lines = source.splitlines() has_result = False for i, line in enumerate(lines, 1): stripped = line.strip() if not stripped or stripped.startswith("#"): continue # ── SEC-4001: forbidden import ── m = re.match(r'^(?:import|from)\s+([\w.]+)', stripped) if m: mod = m.group(1).split(".")[0] if mod not in IMPORT_WHITELIST: violations.append({ "rule_id": "SEC-4001", "line": i, "message": f"Forbidden import: {mod}", "fix": f"Remove 'import {mod}'. Allowed: {', '.join(sorted(IMPORT_WHITELIST))}. " f"call_cli is pre-injected — do not import it.", }) # ── OBF-3018: print() ── if re.search(r'\bprint\s*\(', stripped): violations.append({ "rule_id": "OBF-3018", "line": i, "message": "print() disallowed", "fix": "Remove print(); assign data to 'result' instead (dict or list).", }) # ── SEC-4002: eval / exec / reflection ── for fn in FORBIDDEN_FUNCS: if ...[truncated 3886 chars]- Remediation
View remediation
Remediation Suggestions
- Replace security-critical regular-expression validation with parsing through Python's
astmodule. - Reject attribute paths that expose prohibited modules or capabilities, including chains such as
uuid.os, sensitive frame attributes, and all disallowed dunder attributes. - Use a positive allowlist for accessible members of each permitted module rather than trusting every attribute exported by a whitelisted top-level module.
- Resolve imported aliases and attribute aliases so that indirect forms cannot bypass checks.
- Ensure the local validator implements every rule promised by
SKILL.mdandreferences/runscript-contract.md, including direct-network restrictions, dunder-chain restrictions, dynamic formatting restrictions, blocked parameter values, andcall_clireachability. - Add regression tests that must fail for at least:
import uuid; uuid.os.system(...)- Sensitive dunder and frame-attribute chains
- Aliased or nested prohibited attribute access
- Indirect network access through permitted modules
- Scripts whose
call_cliinvocation is unreachable
- Treat local validation as defense in depth and retain equivalent enforcement in the remote runtime. Do not report a script as contract-compliant when a documented rule was not evaluated.
- Replace security-critical regular-expression validation with parsing through Python's