T09 · Insecure Skill Coding Practices
Error
- Location
index.js:76- Finding
Untrusted benchmark tasks execute with host privileges and inherited environment secrets
- Content
View full analysis
{ const child = spawn(language.command.split(' ')[0], [...language.command.split(' ').slice(1), fullFile], { timeout: CONFIG.timeout, cwd: tempDir, env: { ...process.env, NODE_ENV: 'test' } } ); ``` ### Technical Analysis The benchmark runner treats `task.input.code` and `task.input.test_code` as executable source code and invokes the corresponding host interpreter without an isolation boundary. The spawned process: - Runs with the same operating-system identity and privileges as the benchmark runner. - Inherits all environment variables through `{ ...process.env }`. - Retains normal access to the host filesystem. - Is not prevented from making network connections. - Can create additional child processes. - Is not subject to the declared `CONFIG.memoryLimit`; that value is never enforced. The timeout only attempts to terminate the immediate process. It does not establish filesystem, network, process-count, privilege, or memory isolation. It may also fail to terminate descendants created by the executed task. Although the bundled root tasks are benign, support for custom task files makes task content an executable trust boundary. ### Attack Path 1. An attacker supplies or modifies a custom benchmark task file. 2. The task places a malicious Python, Node.js, or Go payload in `input.co ...[truncated 987 chars]- Remediation
View remediation