T09 · Insecure Skill Coding Practices
Error
- Location
src/code-mode.js:178- Finding
Code Mode Executes Arbitrary JavaScript and PowerShell with Host Privileges
- Content
View full analysis
{ try { const result = await (async () => { ${code} })(); console.log('__RESULT_START__' + JSON.stringify(result) + '__RESULT_END__'); } catch (error) { console.error('__ERROR_START__' + error.message + '__ERROR_END__'); process.exit(1); } })(); `.trim(); fs.writeFileSync(tmpFile, wrappedCode); const child = spawn('node', [tmpFile], { stdio: ['pipe', 'pipe', 'pipe'], env: { ...process.env }, timeout, }); ``` The PowerShell path similarly executes supplied code and explicitly bypasses PowerShell execution policy: ```javascript const wrappedCode = ` $ErrorActionPreference = 'Stop' try { $result = & { ${code} } if ($result -ne $null) { Write-Output "__RESULT_START__" Write-Output ($result | ConvertTo-Json -Depth 10) Write-Output "__RESULT_END__" } } catch { Write-Error "__ERROR_START__$($_.Exception.Message)__ERROR_END__" exit 1 } `.trim(); fs.writeFileSync(tmpFile, wrappedCode, 'utf8'); const child = spawn('powershell.exe', [ '-NoProfile', '-ExecutionPolicy', 'Bypass', '- ...[truncated 2761 chars]- Remediation
View remediation