T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/audit-structure.sh:10
- Finding
- Arbitrary Shell Command Execution Through Unsafe Configuration Loading## Vulnerability Details **File Location**: `scripts/audit-structure.sh`, lines 10–14 **Vulnerability Type**: Unrestricted execution of a configuration file as Bash code **Risk Level**: High ### Vulnerable Code ```bash CONF="${AUDIT_CONFIG:-$SKILL_DIR/audit.conf}" # Load custom limits if config exists if [ -f "$CONF" ]; then # shellcheck source=/dev/null source "$CONF" fi ``` ### Technical Analysis The script documents `audit.conf` as a data-only configuration file containing numeric size limits. However, Bash's `source` command does not parse the file as data; it executes every statement in the file in the current shell process. Consequently, any command placed in the selected configuration file runs with the privileges and environment of the user or Agent invoking the audit. The risk is increased because the `AUDIT_CONFIG` environment variable can select an arbitrary readable file. The script performs no path restriction, ownership or permission validation, key allowlisting, value validation, or rejection of executable shell syntax. This issue is classified as `T09: Insecure Skill Coding Practices` because an unsafe configuration-loading mechanism creates a direct command-execution vulnerability. There is no evidence that the project itself supplies a malicious configuration file. ### Attack Path 1. An attacker gains the ability to create or modify the default `audit.conf` in the Skill directory, or influence the `AUDIT_CONFIG` environment variable used when the audit runs. 2. The attacker places arbitrary shell commands in the selected file, for example: ```bash AGENTS_LIMIT=1000 attacker_controlled_command ``` 3. A user or Agent runs `scripts/audit-structure.sh`, directly or through `scripts/audit-all.sh`. 4. The script confirms only that the selected path is a regular file. 5. `source "$CONF"` executes the attacker's commands in the audit process. 6. The commands inherit the invo ...[truncated 922 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `source "$CONF"` and treat the configuration strictly as data. 2. Accept only an explicit allowlist of supported keys: - `AGENTS_LIMIT` - `SOUL_LIMIT` - `USER_LIMIT` - `IDENTITY_LIMIT` - `TOOLS_LIMIT` - `HEARTBEAT_LIMIT` - `MEMORY_LIMIT` 3. Validate every value against a strict decimal-integer expression such as `^[0-9]+$`, then enforce reasonable minimum and maximum bounds. 4. Reject unknown keys, duplicate assignments, command substitutions, shell expansions, redirections, and other shell syntax. 5. Prefer a non-executable format such as JSON parsed with Python's standard library, which is already a declared runtime requirement. 6. If `AUDIT_CONFIG` must remain configurable, resolve it to a canonical path and restrict it to an approved directory. Validate that it is a regular file, is not a symbolic link, and has trusted ownership and permissions. 7. Run the audit under a least-privileged account without unnecessary secrets in its environment. A safe parser should read each permitted assignment as text and assign validated values without `eval`, `source`, or equivalent dynamic execution.