T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:171- Finding
Execution of an Unbundled Working-Directory-Relative Script
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 171-188;references/detail.md, lines 102-147
Vulnerability Type: Untrusted executable path resolution
Risk Level: MediumVulnerable Code
From
SKILL.md, lines 171-188:bash node scripts/tool.mjs discover "Enterprise basic information" node scripts/tool.mjs call biz_fuzzy_search --params '{"key":"Tencent"}' node scripts/tool.mjs call biz_shareholders --params '{"entid":"AerjZTfkSh0"}'bash node --version node scripts/tool.mjs discover "Enterprise" node scripts/tool.mjs call biz_fuzzy_search --params '{"key":"Alibaba"}' > search_result.json ENTID=$(cat search_result.json | python3 -c "import json,sys; print(json.load(sys.stdin)['data'][0]['entid'])") echo "Enterprise ID: $ENTID" node scripts/tool.mjs call biz_basic_info --params "{\"entid\":\"$ENTID\"}" node scripts/tool.mjs call biz_shareholders --params "{\"entid\":\"$ENTID\"}"From
references/detail.md, lines 102-147:python def __init__(self, script_path="scripts/tool.mjs"): self.script_path = script_path self.runtime = self._detect_runtime() def discover_tools(self, keyword): """Discover available tools""" cmd = [self.runtime, self.script_path, "discover", keyword] result = subprocess.run( cmd, capture_output=True, text=True, timeout=30, encoding="utf-8" ) if result.returncode == 0: return result.stdout return f"Query failed: {result.stderr}" def fuzzy_search(self, company_name): """Perform a fuzzy enterprise search""" cmd = [ self.runtime, self.script_path, "call", "biz_fuzzy_search", "--params", json.dumps({"key": company_name}, ensure_ascii=False) ] result = subprocess.run( cmd, capture_output=True, text=True, timeout=30, encoding="utf-8" ) if result.returncode == 0: try: return json.loads(result.stdout) except json.JSONDecodeError: return result.stdout return { ...[truncated 2703 chars]- Remediation
View remediation
Remediation Suggestions
- Bundle the actual
scripts/tool.mjsimplementation inside the Skill package so that its complete behavior can be audited. - Resolve the script path relative to the Skill's trusted installation directory rather than the current working directory.
- Canonicalize the path and verify that it remains within the expected package directory before invoking Node.js.
- Fail closed if the bundled script is absent; do not search for or execute an ambient file with the same relative path.
- Verify the script against a pinned cryptographic digest or signed manifest before execution.
- Check that the script and its parent directories are not writable by untrusted users.
- Run the script in a least-privilege sandbox with restricted filesystem, environment-variable, and network access.
- Pass only the environment variables required for company queries rather than inheriting the entire Agent environment.
- Align the Skill metadata:
allowed-toolsdeclaresreadandexec, while the separatetoolslist also declareswrite. Remove permissions that are not necessary. - Add tests that launch the Skill from an unrelated working directory and confirm that only the package-owned script can be executed.
- Bundle the actual