T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run_command.sh:239- Finding
Arbitrary Python Code Execution Through Unsafe Shell Interpolation
- Content
View full analysis
/dev/null) ``` A second unsafe interpolation occurs while constructing the request body: ```bash BODY=$(python3 -c " import json, sys with open('${COMMANDS_FILE}') as f: cmds = json.load(f) template = cmds['${ACTION}']['body_template'] body_str = json.dumps(template) body_str = body_str.replace('{{image}}', '${IMAGE_URL}') print(body_str) " 2>/dev/null) ``` ### Technical Analysis The script embeds `INPUT_JSON` and `IMAGE_URL` directly inside Python string literals passed to `python3 -c`. These values are treated as Python source code before they are treated as data. Shell quoting does not provide protection at the Python parsing layer. A crafted value containing the terminating Python quote sequence can escape the intended string literal and append arbitrary Python statements. The initial `json.loads()` validation is ineffective because Python must first compile and execute the dynamically constructed source. The same flaw affects `IMAGE_URL`. If an attacker can cause a malicious image URL to reach the body-construction block, the URL is inserted into another single-quoted Python literal without escaping. This is a code injection vulnerability rather than ordinary malformed JSON handling. Injected Python inherits the privileges, environment variables, filesystem access, and network access of the Skill runner. ### Attack Path 1. An attacker supplies a crafted value through `--input-json`, directly or through an Agent workflow that forwards user-controlled JSON. 2. The value contains characters that terminate the triple-single-quoted Pyth ...[truncated 1285 chars]- Remediation
View remediation