T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:34
- Finding
- Execution of Unbundled Scripts Through Unsafe Relative Paths## Vulnerability Details **File Location**: `SKILL.md`, lines 34–75 **Vulnerability Type**: Execution of unverified code outside the audited Skill package **Risk Level**: Medium ### Vulnerable Code ```bash # SKILL.md:34 python3 ../../scripts/create_product_repo.py "My Extension" --publish-type prototype-local --git-init # SKILL.md:51 python3 ../../scripts/validate_release_profile.py /path/to/product-repo/extension.release.json # SKILL.md:57 python3 ../../scripts/generate_release_plan.py /path/to/product-repo/extension.release.json # SKILL.md:63 python3 ../../scripts/generate_store_listing.py /path/to/product-repo/extension.release.json # SKILL.md:69 python3 ../../scripts/generate_design_brief.py /path/to/product-repo/extension.release.json # SKILL.md:75 python3 ../../scripts/execute_release_cycle.py /path/to/product-repo/extension.release.json ``` ### Technical Analysis The Skill instructs the Agent to execute several Python scripts through the relative path `../../scripts/`. The audited project contains only `SKILL.md` and `agents/openai.yaml`; none of the referenced scripts are included in the package. Relative paths are resolved from the process's current working directory, not necessarily from a trusted or verified Skill root. Consequently, the identity and contents of the executed scripts depend on the environment in which the commands are run. The `../..` traversal also directs execution outside the audited project boundary. If an attacker can create or replace files in the resolved parent `scripts` directory, the documented commands can execute attacker-controlled Python code. Because Python scripts run without isolation by default, such code receives the same operating-system privileges and environmental access as the Agent or user invoking the command. If the expected external scripts are absent, the immediate benign outcome is workflow failure rather than code execution. ### Attack Path 1. An ...[truncated 1528 chars]
- Remediation
- ## Remediation Suggestions 1. Include all required scripts inside a reviewed directory within the Skill package, such as `scripts/`, rather than relying on files outside the project. 2. Resolve script locations from a trusted, canonical Skill root instead of the current working directory. 3. Canonicalize each path and verify that it remains within the expected package directory before execution. 4. Reject missing scripts rather than searching for or implicitly trusting similarly named files elsewhere. 5. Pin released script contents using package signatures or cryptographic hashes and verify integrity before execution. 6. Run release tooling with least privilege in a restricted environment that exposes only the required product repository and excludes unnecessary credentials. 7. Document the trusted source, version, and expected digest of every external tool if bundling is not possible. 8. Prefer a fixed invocation pattern such as `python3 "$VERIFIED_SKILL_ROOT/scripts/execute_release_cycle.py" ...`, where `VERIFIED_SKILL_ROOT` has been canonicalized and validated.