T09 · Insecure Skill Coding Practices
Error
- Location
scripts/poll_background.sh:15- Finding
Arbitrary Shell Code Execution Through Incorrect Project Root Resolution
- Content
View full analysis
, go up 3 levels) SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" PROJECT_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)" # 加载环境 if [ -f "${PROJECT_ROOT}/.env" ]; then source "${PROJECT_ROOT}/.env" export LAS_API_KEY LAS_REGION fi # 激活虚拟环境 if [ -d "${PROJECT_ROOT}/.las_venv" ]; then source "${PROJECT_ROOT}/.las_venv/bin/activate" fi ``` Related code from `scripts/env_init.sh:15-28`: ```bash SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" PROJECT_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)" # 优先复用项目根目录的虚拟环境，不存在才创建新的 if [ -d "${PROJECT_ROOT}/.las_venv" ]; then source "${PROJECT_ROOT}/.las_venv/bin/activate" elif [ ! -d ".las_venv" ]; then python3 -m venv .las_venv source .las_venv/bin/activate else source .las_venv/bin/activate fi ``` ### Technical Analysis The scripts assume the package is installed under a layout such as `project/skills//scripts`. In the audited directory layout, the scripts are located directly under `artifact/scripts`. Traversing three parent directories from that location resolves `PROJECT_ROOT` to `/tmp`, rather than to the artifact directory. Consequently, the polling script may execute `/tmp/.env`, and both scripts may execute `/tmp/.las_venv/bin/activate`. The `source` command interprets these files as shell programs rather than as passive configuration data. Any shell commands contained in them execute in the current shell with the privileges and environment of the user running the skill. Because `/tmp` is a shared, predictable location, another local user, process, or previously executed package may be able to create the ex ...[truncated 1735 chars]- Remediation
View remediation
&2 return 1 2>/dev/null || exit 1 fi ``` 3. Do not execute `.env` as shell code. Parse only explicitly allowed variable assignments such as `LAS_API_KEY` and `LAS_REGION`, rejecting command substitutions, shell operators, and unknown fields. 4. Keep the virtual environment inside the validated project directory or another private directory owned by the current user. Before activation, verify ownership and permissions with `stat`, reject symbolic links, and ensure the directory is not group- or world-writable. 5. Quote all paths and use `--` where supported to prevent option interpretation. 6. Add automated tests that execute the scripts from the repository root and from unrelated working directories, asserting that `PROJECT_ROOT` always resolves to the artifact directory and never to `/tmp`. ]]>