T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/validate_skill.py:169
- Finding
- Static Validator Executes Python Files from an Untrusted Target Package## Vulnerability Details **File Location**: `scripts/validate_skill.py`, lines 169–194 **Vulnerability Type**: Arbitrary local code execution during package validation **Risk Level**: High ### Vulnerable Code ```python def validate_scripts(root: Path, errors: list[str], warnings: list[str]) -> list[dict[str, Any]]: results: list[dict[str, Any]] = [] scripts_dir = root / "scripts" if not scripts_dir.exists(): return results for script in sorted(scripts_dir.glob("*.py")): try: proc = subprocess.run( [sys.executable, str(script), "--help"], cwd=str(root), text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=10, ) except subprocess.TimeoutExpired: errors.append(f"{script.relative_to(root)} --help timed out.") results.append({"script": str(script.relative_to(root)), "help_ok": False, "reason": "timeout"}) continue ok = proc.returncode == 0 and "usage" in proc.stdout.lower() if not ok: errors.append(f"{script.relative_to(root)} --help failed or did not print usage.") ``` The execution is enabled through the caller-controlled validation option: ```python root = Path(args.path).resolve() ... script_results = validate_scripts(root, errors, warnings) if args.check_scripts else [] ``` ### Technical Analysis The validator accepts an arbitrary package root and, when `--check-scripts` is supplied, discovers every `*.py` file beneath that root's `scripts/` directory and invokes it with the current Python interpreter. Supplying `--help` does not make this operation safe. Python executes module-level statements before a script processes command-line arguments. Consequently, an attacker-controlled script can execute an arbitrary payload before displaying help, exiti ...[truncated 1903 chars]
- Remediation
- ## Remediation Suggestions 1. **Remove runtime execution from static validation.** Do not invoke package scripts merely to verify their help output. 2. Parse Python files with `ast.parse()` to validate syntax without executing module-level statements. 3. Inspect `argparse` usage statically where practical, or treat help-output testing as a separate operation that is disabled for untrusted packages. 4. If execution is operationally necessary, require an explicit trusted-package flag and display a clear warning that arbitrary code will run. 5. Execute runtime checks inside a hardened sandbox with: - No inherited credentials or sensitive environment variables. - No network access. - A read-only package mount. - No writable host directories. - A dedicated unprivileged user. - Process, memory, and execution-time limits. - Restrictions on child-process creation where supported. 6. In automated review systems, separate static inspection from post-approval runtime testing and never run unreviewed scripts on a privileged CI worker.