T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:114
- Finding
- Candidate Python Code Is Executed Without Required Isolation## Vulnerability Details **File Location**: `SKILL.md`, lines 114–127 **Vulnerability Type**: Unrestricted execution of candidate code **Risk Level**: High ```bash python evaluator.py <path_to_init.py> ``` The surrounding instructions require the evaluator to execute `init.py` and repeat execution after modifications until validation succeeds. However, they do not require sandboxing, network isolation, privilege reduction, filesystem restrictions, or resource controls. ### Technical Analysis The Skill directs the agent to generate or accept a candidate Python script and execute it through `evaluator.py`. The evaluator interface accepts a candidate path, and the documented system constraints only address the subprocess working directory. They do not establish a security boundary for candidate execution. Python code executed this way inherits the evaluator process's operating-system identity, environment variables, accessible filesystem resources, and network access. A malicious candidate can therefore perform actions unrelated to the intended optimization task, including reading sensitive files, modifying project content, launching additional processes, or communicating with external systems. A timeout parameter alone does not mitigate these risks. It may limit execution duration, but it does not prevent data access, network communication, process creation, or destructive filesystem operations before the timeout expires. ### Attack Path 1. An attacker supplies task requirements, existing project content, or a candidate path that influences the generated or selected `init.py`. 2. The resulting candidate contains malicious Python code disguised as a valid task solution. 3. The agent follows the validation instructions and invokes `evaluator.py` with the candidate path. 4. The evaluator launches the candidate without a required sandbox or reduced privileges. 5. The candidate inherits the evaluator's ambient permissions and accesses available files, cr ...[truncated 1004 chars]
- Remediation
- ## Remediation Suggestions 1. Execute every candidate in a disposable sandbox or container rather than directly on the host. 2. Run the sandbox under a dedicated unprivileged user with no access to host credentials or unrelated files. 3. Disable network access by default. Permit only explicitly documented destinations when network access is essential. 4. Mount the candidate and required input data as read-only. Provide a separate size-limited output directory. 5. Pass a minimal, allowlisted environment and remove tokens, proxy credentials, cloud metadata access, and other secrets. 6. Apply strict CPU, memory, storage, execution-time, open-file, and process-count limits. 7. Prevent access to host sockets, device files, container runtimes, SSH agents, and privileged APIs. 8. Resolve and validate the candidate path before execution, rejecting paths outside the approved workspace and disallowing symlink escapes. 9. Require explicit human review before executing externally supplied or substantially modified candidates. 10. Treat evaluator output as untrusted and limit output size to prevent terminal injection and resource exhaustion. 11. Document sandbox failure as a validation failure; the evaluator must not fall back to unsandboxed execution.