T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:154- Finding
Arbitrary Python Code Injection Through Untrusted Task Metadata
- Content
View full analysis
/dev/null; then python3 -c " import json with open('$ACTIVE_TASKS_FILE', 'r') as f: data = json.load(f) if not any(t['task_id'] == '$TASK_ID' for t in data['tasks']): data['tasks'].append({ 'task_id': '$TASK_ID', 'session': '$TASK_ID', 'branch': '$BRANCH', 'worktree': '$WORKTREE_DIR', 'started_at': '$TIMESTAMP', 'status': 'pending', 'backend': '$BACKEND', 'description': '''$TASK_DESC''', 'pid': None }) with open('$ACTIVE_TASKS_FILE', 'w') as f: json.dump(data, f, indent=2) print('[setup] Registered task in active-tasks.json (via python3).') else: print('[setup] Task already in active-tasks.json — skipping.') " 2>/dev/null || echo "[setup] WARNING: Could not update active-tasks.json." ``` ### Technical Analysis The fallback implementation constructs a Python program dynamically using a double-quoted shell string. Multiple externally supplied values are interpolated directly into Python source code: - `TASK_ID` - `BRANCH` - `WORKTREE_DIR` - `TASK_DESC` These values are not encoded as Python string literals. In particular, a quotation mark or suitable Python syntax in `TASK_ID`, `BRANCH`, or `WORKTREE_DIR` can terminate the intended literal and inject additional statements. Although `TASK_DESC` is surrounded by triple quotes, a description containing the matching triple-quote delimiter can also escape its assigned value. The vulnerable branch runs when `jq` is unavailable and `python3` is present. Suppression of standard error does not prevent execution; it only makes exploitation attempts and failures less visible. ### Attack Path 1. An attacker supplies or influences a task ID, branch, worktree path, or task description processed by `s ...[truncated 1050 chars]- Remediation
View remediation