T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sandbox.py:223- Finding
Ineffective Sandbox Allows Unrestricted Execution of Untrusted Code
- Content
View full analysis
Vulnerability Details
File Location:
scripts/sandbox.py:223-285
Vulnerability Type: Ineffective security controls and unsafe execution of untrusted code
Risk Level: HighVulnerable Code
python def run_sandbox(script_path, monitor, timeout=60, fake_env=False, restricted=False): """Run a script in a subprocess-isolated sandbox. SECURITY: Uses subprocess isolation instead of exec() to prevent: - Frame traversal recovering real builtins - /proc/self/environ reads of host environment - gc.get_objects() report tampering - Raw socket exfiltration bypassing urllib patches - ctypes, mmap, os.open() filesystem bypasses The script runs as a separate Python process with: - Sanitized environment (no real credentials) - Restricted working directory (tmpdir) - Stdout/stderr captured for analysis - Timeout enforcement at the OS level """ import subprocess as _subprocess script_path = Path(script_path) if not script_path.exists(): print(f"ERROR: Script not found: {script_path}", file=sys.stderr) return False # Read script for static analysis before execution with open(script_path) as f: code = f.read() # Static analysis: log observations suspicious_patterns = [ ("__traceback__", "frame traversal attempt"), ("f_back", "frame traversal attempt"), ("f_globals", "frame traversal attempt"), ("/proc/self", "/proc filesystem access"), ("gc.get_objects", "garbage collector introspection"), ("ctypes", "ctypes FFI access"), ("socket.socket", "raw socket creation"), ("os.system", "os.system shell execution"), ("os.popen", "os.popen shell execution"), ("os.fork", "process forking"), ("os.exec", "process exec"), ("mmap", "memory-mapped file access"), ("importlib", "dynamic module import"), ] for pattern, description in suspicious_patterns: ...[truncated 3766 chars]- Remediation
View remediation
Remediation Suggestions
- Do not execute untrusted code directly on the host under the caller’s account.
- Use a disposable container or virtual machine with a dedicated unprivileged user.
- Disable network access by default using an enforceable network namespace or equivalent platform mechanism.
- Mount inspected Skill content read-only and expose only a dedicated temporary output directory as writable.
- Do not mount the user’s home directory, credentials, SSH agent, cloud configuration, runtime sockets, or other host-sensitive resources.
- Apply process, CPU, memory, file-size, and execution-time limits.
- Use platform controls such as seccomp, AppArmor, SELinux, Capsicum, or sandbox-exec where appropriate.
- Prevent privilege escalation by dropping capabilities, enabling
no_new_privileges, and prohibiting privileged containers. - Collect network, filesystem, and process telemetry from outside the untrusted process rather than relying on Python monkey-patching.
- Make
--restrictedfail closed if enforceable isolation cannot be established. - Implement
--monitor-networkusing real external telemetry or remove the option. - Remove claims such as “true process isolation” and “run any skill safely” until they accurately describe implemented guarantees.
- Clearly distinguish static warnings from runtime observations in the generated report.
- Add integration tests proving that restricted mode blocks outbound sockets, host-file reads and writes, and child-process execution.