T09 · Insecure Skill Coding Practices
Error
- Location
src/code-mode.js:178- Finding
Code Mode Executes Arbitrary Code with Host Privileges Despite Being Described as a Sandbox
- Content
View full analysis
{ try { const result = await (async () => { ${code} })(); console.log('__RESULT_START__' + JSON.stringify(result) + '__RESULT_END__'); } catch (error) { console.error('__ERROR_START__' + error.message + '__ERROR_END__'); process.exit(1); } })(); `.trim(); fs.writeFileSync(tmpFile, wrappedCode); const child = spawn('node', [tmpFile], { stdio: ['pipe', 'pipe', 'pipe'], env: { ...process.env }, timeout, }); ``` The PowerShell path provides equivalent unrestricted execution and explicitly bypasses execution policy: ```javascript const child = spawn('powershell.exe', [ '-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', tmpFile ], { stdio: ['pipe', 'pipe', 'pipe'], timeout, }); ``` ### Technical Analysis `CodeModeConverter.execute()` accepts a raw code string, embeds it into a temporary script, and runs it using the host's normal Node.js or PowerShell interpreter. This is process separation, not security isolation. The child process retains the privileges of the parent process. The JavaScript execution path explicitly copies the complete parent environment through `env: { ...process.env }`, exposing API keys, ...[truncated 2275 chars]- Remediation
View remediation