T09 · Insecure Skill Coding Practices
Error
- Location
scripts/create-agent.py:61- Finding
Generated agents expose unrestricted filesystem and shell-command capabilities
- Content
View full analysis
str: """Read the contents of a file. Args: path: Path to the file to read. """ with open(path) as f: return f.read() @tool def write_file(path: str, content: str) -> str: """Write content to a file, creating it if it doesn't exist. Args: path: Path to the file to write. content: Content to write to the file. """ from pathlib import Path Path(path).parent.mkdir(parents=True, exist_ok=True) with open(path, "w") as f: f.write(content) return f"Wrote {{len(content)}} bytes to {{path}}" @tool def run_command(command: str) -> str: """Run a shell command and return its output. Args: command: Shell command to execute. """ import subprocess result = subprocess.run(command, shell=True, capture_output=True, text=True, timeout=60) output = result.stdout if result.stderr: output += f"\\nSTDERR: {{result.stderr}}" if result.returncode != 0: output += f"\\nExit code: {{result.returncode}}" return output ``` ```python agent = Agent( model=model, system_prompt="""You are {name}, a helpful AI agent. Be direct and efficient. You have access to tools for reading/writing files and running commands. Use them as needed to accomplish tasks. ... """, tools=[read_file, write_file, run_command], ) ``` ### Technical Analysis Every scaffolded agent receives tools that can read arbitrary paths, create or overwrite arbitrary files, and execute arbitrary shell commands. No workspace boundary, path validation, command allowlist, sandbox, user-confirmation mechanism, or privilege reduction is applied. The `run_command` tool passes model-generated text directly ...[truncated 1889 chars]- Remediation
View remediation