T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:14
- Finding
- Unsafe PowerShell Execution-Policy Bypass for an Unavailable Relative Script<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14–24 **Vulnerability Type**: Unsafe execution configuration and untrusted relative script resolution **Risk Level**: Medium ### Vulnerable Code ```markdown 2. Run `scripts/generate-mobile-pairing.ps1` to generate pairing code. 3. Return: - Pairing code - Output file path - Quick next step for mobile user ## Command Template ```powershell powershell -ExecutionPolicy Bypass -File scripts/generate-mobile-pairing.ps1 -BffBaseUrl "<https://api.yourdomain.com/>" -CopyToClipboard ``` ``` ### Technical Analysis The skill directs the agent to execute `scripts/generate-mobile-pairing.ps1` with PowerShell's execution policy bypassed. However, the audited package contains only `SKILL.md` and `VERSION.txt`; the referenced script is absent. Because `-File` uses a relative path, script resolution may depend on the process's current working directory rather than a verified package directory. If an attacker can create or replace `scripts/generate-mobile-pairing.ps1` at the resolved location, the agent may execute attacker-controlled PowerShell code. The `-ExecutionPolicy Bypass` option suppresses an execution-policy safeguard that could otherwise prevent or warn about execution of an untrusted script. The skill metadata also claims that the operation automatically reads the local gateway token. Since the implementation is unavailable, its handling of that authentication material cannot be audited. It is therefore impossible to verify whether the token would be embedded in the pairing code, copied to the clipboard, written to a file, or transmitted to the supplied BFF endpoint. ### Attack Path 1. The attacker obtains write access to the agent's working directory or otherwise influences the directory from which the relative script path is resolved. 2. The attacker creates a malicious file at `scripts/generate-mobile-pairing.ps1`. 3. A user invokes the mobile-pairing skill. 4. The agent fo ...[truncated 1159 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Include `scripts/generate-mobile-pairing.ps1` in the distributed package so its behavior and token handling can be reviewed. 2. Remove `-ExecutionPolicy Bypass`. Use an appropriately signed script and an execution policy consistent with the deployment environment. 3. Resolve the script from the trusted skill installation directory using a canonical absolute path rather than relying on the current working directory. 4. Before execution, verify that the canonical script path remains inside the expected package directory and reject symbolic links, path traversal, or unexpected replacements. 5. Verify the script's integrity using a trusted signature or pinned cryptographic hash. 6. Validate the BFF URL, require HTTPS, and restrict connections to explicitly trusted hosts where operationally feasible. 7. Ensure the gateway token is never embedded in reusable pairing output, logged, copied to the clipboard, or written to plaintext files. 8. Store generated output with restrictive permissions and a short expiration time, and redact sensitive values from errors and diagnostic output. 9. Fail safely when the script is missing rather than searching for or executing a same-named file from another location. ]]>