T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/detect_environment.py:899
- Finding
- Unrestricted Command Execution Through Probe Files<![CDATA[ ## Vulnerability Details **File Location**: - `scripts/detect_environment.py:509-513` - `scripts/detect_environment.py:899-906` - `scripts/detect_environment.js:537-540` - `scripts/detect_environment.js:846-854` - `references/probe-file.md:83-87` **Vulnerability Type**: Arbitrary command execution through trusted configuration **Risk Level**: High ### Vulnerable Code Python probe loading and command execution: ```python def load_probe_file(path: str | None) -> dict[str, Any]: if not path: return {} probe_path = Path(path) return json.loads(probe_path.read_text(encoding="utf-8-sig")) ``` ```python def run_checks(extra_probe_data: dict[str, Any], baseline_data: dict[str, Any] | None) -> dict[str, Any]: existing_checks = deepcopy((baseline_data or {}).get("checks", {})) if not extra_probe_data.get("checks"): return existing_checks for check in extra_probe_data["checks"]: command = check["command"] result = run_command(command, timeout=check.get("timeout", 8), cwd=check.get("cwd")) ``` JavaScript equivalent: ```javascript function loadProbeFile(pathname) { if (!pathname) return {}; return JSON.parse(readText(pathname)); } ``` ```javascript function runChecks(extraProbeData, baselineData) { const existingChecks = deepClone((baselineData || {}).checks || {}); if (!extraProbeData.checks) return existingChecks; for (const check of extraProbeData.checks) { const result = runCommand(check.command, { timeout: check.timeout == null ? 8 : check.timeout, cwd: check.cwd || null, }); ``` The documented command field explicitly permits direct execution: ```markdown - `command` - Command array executed exactly as provided. ``` ### Technical Analysis Probe files are parsed as JSON and then treated as trusted executable configuration. The `checks[].command`, `cwd`, and timeout fields are accepted without command allowlisting, path restrictions, a safety preview, or explici ...[truncated 2009 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat every probe file as executable code and clearly document that untrusted probe files must never be used. 2. Add an explicit opt-in flag such as `--allow-command-execution`; reject `checks` unless it is present. 3. Display the complete commands, working directories, and requested environment variables before execution and require interactive or caller-supplied approval. 4. Prefer declarative, built-in read-only probe types over arbitrary commands. 5. Allowlist approved executables and argument forms for common service, port, and file-existence checks. 6. Reject shell interpreters and command processors by default, including `bash`, `sh`, `zsh`, `cmd.exe`, and PowerShell. 7. Restrict `cwd` to an approved project root and reject traversal outside that root. 8. Validate the complete probe-file schema, including field types, array sizes, timeout limits, and command lengths. 9. Execute approved probes in a sandbox with minimal filesystem, environment, and network access where platform support permits. 10. Avoid passing the detector's complete environment to child processes; construct a minimal environment explicitly. ]]>