T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:22
- Finding
- Execution of Unverified Code Outside the Skill Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 22–25 **Vulnerability Type**: Untrusted external code execution caused by an unsafe hardcoded path **Risk Level**: Medium ### Vulnerable Code ```bash cd /home/workspace/MoneyMachine/x402_server node index.js ``` ### Technical Analysis The skill instructs the agent to execute `index.js` from the hardcoded `/home/workspace/MoneyMachine/x402_server` directory. This directory is outside the reviewed skill package, and the referenced script is not included in the project. Consequently, its contents, dependencies, payment configuration, network behavior, and integrity cannot be verified by this audit. The instruction crosses a trust boundary by assuming that a mutable external filesystem location contains legitimate code. Any user or process able to create or modify files at that location could control the code executed when the documented command is followed. There is no integrity check, ownership validation, path validation, dependency lock verification, or user confirmation before execution. This is classified as `T09: Insecure Skill Coding Practices` because the skill uses an unsafe hardcoded external execution path. The available evidence does not establish that the absent script is malicious or that it retrieves remote payloads. ### Attack Path 1. An attacker or compromised local process obtains write access to `/home/workspace/MoneyMachine/x402_server` or its `index.js` file. 2. The attacker creates or replaces `index.js` with attacker-controlled JavaScript. 3. A user or agent invokes the skill and follows its documented startup command. 4. Node.js executes the substituted script with the invoking process's permissions. 5. The script can perform any operation available to that account, including accessing readable files, making network requests, opening a listener, or changing payment-routing configuration. Exploitation depends on the attacker having write access to the reference ...[truncated 735 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Include the complete server implementation in the skill package so it can be reviewed together with the instructions. 2. Resolve executable paths relative to the trusted skill directory instead of using a mutable hardcoded external location. 3. Verify the script's cryptographic hash or signed release before execution. 4. Validate directory and file ownership and reject files writable by untrusted users. 5. Pin Node.js dependency versions with a lockfile and use package-manager integrity verification. 6. Document and validate the payment recipient, facilitator, network, and middleware configuration before starting the service. 7. Require explicit user approval before launching a persistent network-facing process or performing payment-related operations. 8. Run the service with a dedicated least-privileged account or sandbox, restricting filesystem access, outbound network access, environment variables, and listening interfaces to what is strictly required. ]]>