T09 · Insecure Skill Coding Practices
Error
- Location
- references/tle-sources.md:27
- Finding
- Unvalidated Execution of Target-Repository Build Code## Vulnerability Details **File Location**: `references/tle-sources.md`, lines 27–40 **Vulnerability Type**: Untrusted local code execution through repository-controlled build entry points **Risk Level**: High **Complete Code Snippet**: ```bash # Option A: project-provided build script (if present) if [ -x ./build.sh ]; then ./build.sh elif [ -x ./scripts/build.sh ]; then ./scripts/build.sh fi # Option B: editable python rebuild path (if your project uses setuptools/pyproject) <py_exec> -m pip install -e . # Option C: CMake/Ninja path (if your project is cmake-based) ninja -C <build_dir> ``` ### Technical Analysis The skill instructs the agent to execute build entry points controlled by the target repository. The only check applied to `build.sh` and `scripts/build.sh` is whether the file is executable. This does not establish that the script is trusted or safe. A malicious repository can place arbitrary shell commands in either location. The editable installation command can likewise execute repository-controlled build logic through files such as `pyproject.toml`, `setup.py`, build-system hooks, or native compilation steps. The CMake/Ninja path may also execute commands defined by repository-controlled build configuration. The instructions do not require source inspection, provenance validation, explicit user approval, sandboxing, network isolation, credential removal, or filesystem restrictions before execution. Consequently, invoking this workflow against an untrusted or compromised repository can turn an ordinary build step into arbitrary local command execution. ### Attack Path 1. An attacker creates or compromises a TLE project repository. 2. The attacker adds a malicious executable `build.sh` or `scripts/build.sh`. Alternatively, the attacker embeds malicious build hooks in Python or CMake project metadata. 3. A user asks the agent to build, modify, debug, or validate that repository using this ...[truncated 1145 chars]
- Remediation
- ## Remediation Suggestions 1. Do not automatically execute repository-controlled build scripts based only on their presence or executable bit. 2. Require the agent to inspect `build.sh`, `scripts/build.sh`, `pyproject.toml`, `setup.py`, CMake files, and referenced hooks before execution. 3. Present the selected build command and relevant reviewed entry points to the user, then obtain explicit approval before running them. 4. Execute untrusted builds in an ephemeral container or virtual machine with: - No host credential mounts. - A minimal environment with secrets removed. - Read-only access outside the working and build directories. - Non-root execution. - Outbound network access disabled unless specifically required and approved. - CPU, memory, process, and execution-time limits. 5. Pin and verify build dependencies where applicable, and avoid resolving packages from untrusted indexes. 6. Separate source inspection from build execution so that reviewing the repository cannot trigger build hooks. 7. Update the guide to state that all repository-provided build systems are potentially executable code, including editable Python installations and CMake/Ninja configurations.