T09 · Insecure Skill Coding Practices
- Location
main.py:19- Finding
Execution of an Unverified Python Script Outside the Audited Skill Package
- Content
View full analysis
Vulnerability Details
File Location:
main.py:19-25
Vulnerability Type: Execution of external, integrity-unverified local code
Risk Level: HighVulnerable Code
python async def perform(self, *args, **kwargs): # Use an absolute path to your scripts folder current_dir = os.path.dirname(os.path.abspath(__file__)) # Adjust the number of ".." based on your folder depth script_path = os.path.join(current_dir, "..", "..", "scripts", "your_script.py") process = subprocess.run(["python", script_path], capture_output=True, text=True) return process.stdoutTechnical Analysis
The registered skill's
perform()method constructs a script path containing two parent-directory traversals and executes the resultingscripts/your_script.pyfile. The target lies outside the audited skill package and is not included in the reviewed project. The code performs no canonical-path boundary validation, ownership or permission check, integrity verification, or trusted-file verification before execution.Although the subprocess call uses an argument list rather than a shell command and therefore does not directly introduce shell-command injection, it still establishes an unsafe code-execution boundary. Runtime behavior is determined by an external file that can differ from the code reviewed during installation or audit.
The target also does not match the bundled
transtar.pyimplementations. Furthermore,SKILL.md:20-23documents execution oftranstar_diff.py, which is absent. This implementation-to-documentation mismatch makes the actual execution behavior less transparent and increases the likelihood that an unexpected external script will run.Attack Path
- An attacker obtains write access to the external
scriptsdirectory resolved two levels above the skill package. This may occur through weak filesystem permissions, another compromised component, or an unsafe deployment process. - The attacker creates or rep ...[truncated 1080 chars]
- An attacker obtains write access to the external
- Remediation
View remediation
Remediation Suggestions
- Execute only the intended script shipped inside the audited skill package, such as
scripts/transtar.py. - Resolve the target to a canonical path and verify that it remains beneath the canonical skill directory before execution.
- Use
sys.executableinstead of the environment-dependent"python"executable. - Reject symlinked or unexpectedly owned script files where the deployment model permits external modification.
- Apply restrictive filesystem permissions so untrusted users and unrelated components cannot modify executable skill files.
- Consider eliminating the subprocess boundary by importing and calling the bundled implementation directly.
- Add explicit failure handling by checking the subprocess return code, applying a timeout, and safely reporting standard error.
- Update
SKILL.mdso its runbook names the actual bundled entry point and remove references to the absenttranstar_diff.py.
A hardened subprocess implementation could use the following pattern:
python import os import subprocess import sys async def perform(self, *args, **kwargs): skill_dir = os.path.realpath(os.path.dirname(__file__)) script_path = os.path.realpath( os.path.join(skill_dir, "scripts", "transtar.py") ) if os.path.commonpath([skill_dir, script_path]) != skill_dir: raise RuntimeError("Script path escapes the skill directory") process = subprocess.run( [sys.executable, script_path], capture_output=True, text=True, timeout=30, check=True, ) return process.stdout- Execute only the intended script shipped inside the audited skill package, such as