T09 · Insecure Skill Coding Practices
- Location
skill.md:34- Finding
Automatic Execution of AI-Generated, User-Influenced Python Code
- Content
View full analysis
Vulnerability Details
File Location:
skill.md, lines 34 and 48–64
Vulnerability Type: Automatic execution of untrusted generated code
Risk Level: HighVulnerable Code Snippet
text ### Step 2: Generate Manim Code Based on the prompt obtained in Step 1, generate the corresponding Manim Community Edition code, provide instructions for running it locally, and place all generated code in the `annimations` folder under the workspace directory. ### Step 4: Run the Code Requirements: 1. After generating the code, enter its directory and execute the Manim command to produce a low-quality MP4 animation. 2. After generating the video, send it to the user so the user can view it. ## Workflow 1. Receive user input: Wait for the user to provide a simple description of the Manim animation. 2. Generate a detailed prompt: Create a comprehensive animation description according to Step 1. 3. Generate code: Write complete Manim Community Edition code based on the prompt. 4. Provide execution instructions: Explain how to run the code locally. 5. Check the code: Check the generated code for syntax and logic errors. 6. Run the code: Enter the directory containing the generated code and run it to produce a low-quality MP4 video. 7. Return the video: Send the generated video to the user.Technical Analysis
The skill directs the agent to translate user-controlled animation requirements into Python source code and then execute that code through Manim. Manim scene files are ordinary Python modules; importing or rendering them can execute arbitrary top-level statements, imported modules, subprocess operations, filesystem access, and network operations.
The documented validation step only mentions LaTeX formatting, undefined variables, and general syntax issues. It does not require a security review of imports or dangerous APIs, prohibit shell and subprocess execution, constrain filesystem or network access, require human approval, or mandate sandbo ...[truncated 1845 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic execution from the default workflow. Generate the source and display it for review without rendering it automatically.
- Require explicit user or operator approval after showing the complete generated file and the exact Manim command.
- Perform security-focused validation before execution:
- Allow only expected Manim and standard mathematical imports.
- Reject dynamic execution mechanisms such as
eval,exec, and dynamic imports. - Reject process-launching APIs such as
subprocess,os.system, and equivalent calls. - Reject network, credential, environment-variable, and unrestricted filesystem access.
- Reject top-level behavior unrelated to defining approved Manim scenes.
- Execute approved scenes in an isolated container or sandbox using an unprivileged dedicated account.
- Mount source inputs read-only and expose only a dedicated writable output directory.
- Remove secrets and host credentials from the execution environment.
- Disable outbound network access unless it is explicitly required and narrowly allowlisted.
- Apply strict CPU, memory, process, file-size, storage, and execution-time limits.
- Invoke Manim with a fixed executable and validated argument array rather than constructing a shell command from user-controlled values.
- Preserve execution logs and generated-source hashes to support review and incident investigation.