T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fallback-search.sh:6- Finding
Arbitrary Python Code Execution Through an Unsanitized Search Query
- Content
View full analysis
[count]}" ``` ```bash # T3: multi-search-engine (via crawl4ai - 爬百度) echo "Trying T3: crawl4ai → 百度..." if python3 -c " import asyncio from crawl4ai import AsyncWebCrawler async def main(): async with AsyncWebCrawler() as c: r = await c.arun(url='https://www.baidu.com/s?wd=$QUERY') print(r.markdown[:3000]) asyncio.run(main()) " 2>/dev/null; then ``` ### Technical Analysis The script accepts the first command-line argument as `QUERY` and interpolates it directly into Python source supplied to `python3 -c`. Shell quoting does not make the value safe within the generated Python program. An attacker-controlled query containing a single quote and additional Python statements can terminate the URL string and inject arbitrary Python code. For example, a query structurally resembling the following can escape the intended string: ```text '); __import__('os').system(''); # ``` The resulting text is parsed as part of the Python program rather than treated exclusively as search data. The use of `python3 -c` therefore creates a local arbitrary-code-execution primitive. This vulnerability is reachable only when the script proceeds to the T3 fallback, such as after the T1 and T2 search mechanisms fail. That condition does not mitigate the underlying injection issue and may be intentionally induced or occur naturally because of unavailable dependencies, network failures, exhausted quotas, or provider errors. ### Attack Path 1. An attacker supplies or persuades the Agent to use a crafted search query containing Python syntax. 2. The script stores the untrusted argument in `QUERY`. 3. T1, `web-search-plus`, fails or is unavailable. 4. T2, the OpenCLI Google search, also f ...[truncated 1206 chars]- Remediation
View remediation