T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/sandbox.py:223
- Finding
- Ineffective Sandbox Allows Unrestricted Execution of Untrusted Code## Vulnerability Details **File Location**: `scripts/sandbox.py:223-285` **Vulnerability Type**: Ineffective security controls and unsafe execution of untrusted code **Risk Level**: High ### Vulnerable Code ```python def run_sandbox(script_path, monitor, timeout=60, fake_env=False, restricted=False): """Run a script in a subprocess-isolated sandbox. SECURITY: Uses subprocess isolation instead of exec() to prevent: - Frame traversal recovering real builtins - /proc/self/environ reads of host environment - gc.get_objects() report tampering - Raw socket exfiltration bypassing urllib patches - ctypes, mmap, os.open() filesystem bypasses The script runs as a separate Python process with: - Sanitized environment (no real credentials) - Restricted working directory (tmpdir) - Stdout/stderr captured for analysis - Timeout enforcement at the OS level """ import subprocess as _subprocess script_path = Path(script_path) if not script_path.exists(): print(f"ERROR: Script not found: {script_path}", file=sys.stderr) return False # Read script for static analysis before execution with open(script_path) as f: code = f.read() # Static analysis: log observations suspicious_patterns = [ ("__traceback__", "frame traversal attempt"), ("f_back", "frame traversal attempt"), ("f_globals", "frame traversal attempt"), ("/proc/self", "/proc filesystem access"), ("gc.get_objects", "garbage collector introspection"), ("ctypes", "ctypes FFI access"), ("socket.socket", "raw socket creation"), ("os.system", "os.system shell execution"), ("os.popen", "os.popen shell execution"), ("os.fork", "process forking"), ("os.exec", "process exec"), ("mmap", "memory-mapped file access"), ("importlib", "dynamic module import"), ] for pattern, description in suspicious_patterns: ...[truncated 3766 chars]
- Remediation
- ## Remediation Suggestions - Do not execute untrusted code directly on the host under the caller’s account. - Use a disposable container or virtual machine with a dedicated unprivileged user. - Disable network access by default using an enforceable network namespace or equivalent platform mechanism. - Mount inspected Skill content read-only and expose only a dedicated temporary output directory as writable. - Do not mount the user’s home directory, credentials, SSH agent, cloud configuration, runtime sockets, or other host-sensitive resources. - Apply process, CPU, memory, file-size, and execution-time limits. - Use platform controls such as seccomp, AppArmor, SELinux, Capsicum, or sandbox-exec where appropriate. - Prevent privilege escalation by dropping capabilities, enabling `no_new_privileges`, and prohibiting privileged containers. - Collect network, filesystem, and process telemetry from outside the untrusted process rather than relying on Python monkey-patching. - Make `--restricted` fail closed if enforceable isolation cannot be established. - Implement `--monitor-network` using real external telemetry or remove the option. - Remove claims such as “true process isolation” and “run any skill safely” until they accurately describe implemented guarantees. - Clearly distinguish static warnings from runtime observations in the generated report. - Add integration tests proving that restricted mode blocks outbound sockets, host-file reads and writes, and child-process execution.