T09 · Insecure Skill Coding Practices
- Location
scripts/auto-research.sh:60- Finding
Arbitrary Python Code Execution Through Untrusted Topic Interpolation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/auto-research.sh:60-66;scripts/auto-research-v2.sh:23-30
Vulnerability Type: Code injection through an unquoted heredoc
Risk Level: HighVulnerable Code
From
scripts/auto-research.sh:60-66:bash python3 << PYTHON_SCRIPT import json import os from datetime import datetime output_dir = "$OUTPUT_DIR" topic = "$TOPIC"From
scripts/auto-research-v2.sh:23-30:bash python3 << PYTHON_SCRIPT import json import os import urllib.request import urllib.parse from datetime import datetime topic = "$TOPIC" output_dir = "$OUTPUT_DIR"Technical Analysis
Both shell scripts interpolate the attacker-controlled
TOPICargument directly into Python source code inside an unquoted heredoc. The value is not encoded as a Python string literal or passed through a data-only interface such assys.argvor an environment variable.An attacker can provide quotation marks, semicolons, newlines, comments, or other Python syntax that terminates the intended assignment and introduces additional Python statements. For example, a topic shaped like the following can turn the generated source into executable Python code:
text "; __import__('os').system('attacker-controlled-command'); #The resulting Python source is equivalent to:
python topic = ""; __import__('os').system('attacker-controlled-command'); #"This executes before the normal research workflow continues. The vulnerability does not require the topic to be interpreted as a shell command: it is a direct Python source-code injection caused by embedding untrusted data into generated code.
Attack Path
- An attacker supplies or persuades an agent to use a specially crafted research topic.
- The topic is passed as the first command-line argument to either shell script.
- Bash expands
$TOPICwhile constructing the unquoted heredoc. - The expanded value becomes part of the Python program supplied to
python3. - Th ...[truncated 715 chars]
- Remediation
View remediation
Remediation Suggestions
Use a quoted heredoc so that Bash performs no expansion within the Python source, and pass dynamic values through command-line arguments:
bash python3 - "$OUTPUT_DIR" "$TOPIC" <<'PYTHON_SCRIPT' import sys output_dir = sys.argv[1] topic = sys.argv[2] PYTHON_SCRIPTApply the same pattern to every Python heredoc in both shell scripts.
Additional hardening should include:
- Never generate program source by concatenating or interpolating untrusted input.
- Use
sys.argv, environment variables, standard input, or a serialized format such as JSON to transfer data between Bash and Python. - Quote heredoc delimiters as
<<'PYTHON_SCRIPT'. - Add regression tests containing quotes, semicolons, backticks, dollar signs, newlines, and Python syntax.
- Run the research scripts with the minimum filesystem and network privileges required.
- Consider replacing the shell/Python hybrid implementation with a single Python entry point to remove the cross-language injection boundary.