T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/common.py:281
- Finding
- Base64-Encoded Remote Shell Execution Obscures the Effective Payload<![CDATA[ ## Vulnerability Details **File Location**: `scripts/common.py:281-286` **Vulnerability Type**: Encoded shell payload execution **Risk Level**: High ### Vulnerable Code ```python if inline_script is None: command.extend([target, "bash", "-s", "--"]) else: encoded_script = base64.b64encode(inline_script.encode("utf-8")).decode("ascii") remote_command = f"printf %s {shell_quote(encoded_script)} | base64 -d | bash -s --" command.extend([target, remote_command]) ``` The encoded execution path is selected for password authentication in `scripts/common.py:307-322`: ```python ssh_password = config.get("ssh_password") command = build_ssh_command(config, inline_script=script if ssh_password else None) env = os.environ.copy() askpass_script: Optional[str] = None if ssh_password: askpass_script = _make_askpass_script() env["AUTOCLAW_TRAIN_SSH_PASSWORD"] = str(ssh_password) env["SSH_ASKPASS"] = askpass_script env["SSH_ASKPASS_REQUIRE"] = "force" env.setdefault("DISPLAY", "autoclaw:0") try: result = subprocess.run( command, input=None if ssh_password else script, text=True, capture_output=True, timeout=timeout, env=env, ) ``` ### Technical Analysis When password authentication is enabled, the generated remote shell script is Base64-encoded locally, placed directly in the SSH command line, decoded remotely, and piped into `bash`. Base64 does not provide confidentiality or integrity; it only obscures the effective shell payload from ordinary command inspection and security controls that inspect cleartext command arguments. The audit did not find an external recipient or encoded sensitive information, so the static pre-scan concern about covert data exfiltration was not confirmed. Nevertheless, decode-and-execute behavior is unnecessary for SSH password authentication and makes the actual command harder to review and constrain. The decoded script executes with all priv ...[truncated 1194 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove Base64 decode-and-execute behavior. 2. Send the shell script through SSH standard input in both key and password modes: ```python command = build_ssh_command(config, inline_script=None) result = subprocess.run( command, input=script, text=True, capture_output=True, timeout=timeout, env=env, ) ``` 3. Retain `SSH_ASKPASS` only as the authentication mechanism; it does not require the remote program to be embedded in the command line. 4. Prefer a non-root account restricted to the training project and required GPU resources. 5. Log a hash or reviewed representation of the generated script before execution. 6. Enforce server-side SSH restrictions where practical, such as a dedicated account, restricted filesystem permissions, and a forced command wrapper. ]]>