T09 · Insecure Skill Coding Practices
Error
- Location
- create-feishu-agent.sh:89
- Finding
- <![CDATA[Arbitrary Python Code Execution Through Unsafe Heredoc Interpolation]]><![CDATA[ ## Vulnerability Details **File Location**: `create-feishu-agent.sh:89-98` **Vulnerability Type**: Python source injection **Risk Level**: High ### Vulnerable Code ```bash # Use Python to update the configuration python3 << PYTHON_SCRIPT import json import sys config_file = "$CONFIG_FILE" agent_name = "$AGENT_NAME" display_name = "$DISPLAY_NAME" app_id = "$APP_ID" app_secret = "$APP_SECRET" workspace = "$WORKSPACE" ``` ### Technical Analysis The heredoc delimiter is unquoted, and values derived from command-line arguments are interpolated directly into generated Python source code. The script does not escape quotation marks, newlines, backslashes, or Python syntax before placing these values inside Python string literals. An attacker who can influence any of the arguments—particularly `agent_name`, `display_name`, `app_id`, or `app_secret`—can terminate the generated string literal and inject additional Python statements. Those statements execute under the account and privileges of the user running the script. This is not limited to corrupting the JSON configuration. Injected Python can invoke operating-system commands, read local credentials, modify Agent instructions, or overwrite any file accessible to the invoking user. ### Attack Path 1. An attacker convinces a user or automation workflow to run the script with a crafted argument. 2. The malicious argument contains a quote, newline, and valid Python statements that escape the intended assignment. 3. The shell interpolates the argument into the heredoc used as Python source. 4. `python3` parses the attacker-controlled statements as executable code. 5. The payload executes with the privileges of the user running the setup script. For example, a malicious value can conceptually transform: ```python display_name = "<attacker-controlled value>" ``` into multiple Python statements, including calls to `os.system()` or `subprocess`. ### Impact Assessment Successful exploitation provides ar ...[truncated 499 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Do not construct Python source by interpolating shell variables. Use a quoted heredoc and pass data through positional arguments or environment variables. A safer pattern is: ```bash python3 - "$CONFIG_FILE" "$AGENT_NAME" "$DISPLAY_NAME" "$APP_ID" "$APP_SECRET" "$WORKSPACE" <<'PYTHON_SCRIPT' import json import sys config_file, agent_name, display_name, app_id, app_secret, workspace = sys.argv[1:7] with open(config_file, "r", encoding="utf-8") as file: config = json.load(file) # Perform validated configuration updates here. PYTHON_SCRIPT ``` Additional hardening should include: 1. Validate `AGENT_NAME` against a strict allowlist such as `^[A-Za-z0-9_-]+$`. 2. Apply reasonable length limits to every argument. 3. Treat display names and credentials exclusively as data, never generated source. 4. Write configuration changes to a securely created temporary file and atomically replace the original only after successful validation. 5. Preserve restrictive permissions on configuration files containing secrets. ]]>