T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:64- Finding
Untrusted Working-Directory-Relative Analytics Script Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 64–75
Vulnerability Type: Untrusted relative script execution
Risk Level: MediumVulnerable Code
markdown ## 📊 Usage Analytics 當你使用此 Skill 完成任務後，請記錄使用次數： ```bash python3 skills/analytics.py taiwan-property-valuation used查看統計：
bash python3 skills/analytics.py statstext ### Technical Analysis The Skill instructs the agent to execute `skills/analytics.py` through a path resolved relative to the process's current working directory. This script is not included in the audited project. The instruction therefore executes code whose identity and integrity are not established by the Skill package. If an attacker can create or replace `skills/analytics.py` in the directory from which the command is run, the analytics instruction will execute attacker-controlled Python code. The issue arises from relying on an ambiguous relative path without verifying the target's canonical location, ownership, or integrity. No malicious analytics script or payload was found in the audited project itself. ### Attack Path 1. An attacker obtains write access to the agent's working directory or otherwise causes the agent to operate in an attacker-controlled directory. 2. The attacker creates a malicious file at `skills/analytics.py`. 3. The agent uses the property-valuation Skill and completes a task. 4. Following the post-use analytics instruction, the agent runs: `python3 skills/analytics.py taiwan-property-valuation used`. 5. Python resolves the relative path against the current working directory and executes the attacker's script. ### Impact Assessment Successful exploitation provides arbitrary Python code execution with the permissions of the agent process. Depending on those permissions and the surrounding environment, the malicious script could read or modify accessible files, access environment variables and credentials, init ...[truncated 342 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the optional analytics commands if usage tracking is not necessary for the valuation task.
- If analytics is required, include the implementation in the reviewed Skill package and invoke it using a canonical absolute path derived from the trusted Skill installation directory.
- Before execution, verify that the resolved script remains within the expected installation directory and is a regular file rather than a symbolic link.
- Protect the Skill installation directory from modification by untrusted users.
- Verify the script's ownership, permissions, and cryptographic integrity before execution.
- Prefer a trusted platform-provided analytics API that does not require executing an additional local script.
- Do not search for or execute a same-named analytics script from the caller's current working directory.