T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/moderate.sh:39
- Finding
- Arbitrary Python Code Execution Through INJECTION_THRESHOLD<![CDATA[ ## Vulnerability Details **File Location**: `scripts/moderate.sh`, lines 39-65 **Vulnerability Type**: Environment-variable code injection **Risk Level**: High ### Vulnerable Code ```bash THRESHOLD="${INJECTION_THRESHOLD:-0.85}" ``` ```bash INJ_FLAGGED=$(python3 -c "print('true' if float('$INJ_SCORE') >= float('$THRESHOLD') else 'false')") ``` ### Technical Analysis The script reads `INJECTION_THRESHOLD` from the process environment and interpolates it directly into Python source passed to `python3 -c`. The value is placed inside a single-quoted Python string, but the shell does not validate or escape it as Python data. An attacker who can influence this environment variable can terminate the Python string and insert arbitrary Python expressions. For example, a value shaped like the following can cause a command to execute while preserving a syntactically valid expression: ```text 0') or __import__("os").system("id") or float('0 ``` The resulting Python expression executes `os.system("id")`. Exploitation occurs only on the input-processing path when `HF_TOKEN` is configured and the Hugging Face request returns a response from which `INJ_SCORE` is calculated. Although control of the complete process environment is already a strong capability, configuration values are commonly supplied through deployment manifests, CI/CD variables, wrappers, or orchestration interfaces. Treating a documented numeric configuration value as executable source unnecessarily turns limited configuration influence into code execution. ### Attack Path 1. The attacker obtains the ability to set or influence `INJECTION_THRESHOLD`, such as through an exposed deployment setting, CI/CD variable, wrapper process, or unsafe multi-tenant configuration. 2. The attacker assigns a value that closes the Python string and injects a Python expression invoking `os.system`, `subprocess`, or another execution primitive. 3. `HF_TOKEN` is present and the Skill processes a message in the ...[truncated 769 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Never interpolate environment values into executable Python source. Pass both values as positional arguments and parse them strictly as data: ```bash INJ_FLAGGED=$( python3 -c ' import sys score = float(sys.argv[1]) threshold = float(sys.argv[2]) if not 0.0 <= threshold <= 1.0: raise ValueError("Threshold must be between 0 and 1") print("true" if score >= threshold else "false") ' "$INJ_SCORE" "$THRESHOLD" ) ``` Additional hardening should include: 1. Validate `INJECTION_THRESHOLD` before making any external request and reject nonnumeric, non-finite, or out-of-range values. 2. Avoid dynamically generated source code for all configuration handling. 3. Run the script under a dedicated, least-privileged account with a restricted filesystem and network policy. 4. Keep API credentials scoped to the minimum necessary permissions. 5. Add tests using quotes, newlines, Python expressions, `NaN`, infinity, and malformed numeric values. ]]>