50 lines
1.8 KiB
Python
50 lines
1.8 KiB
Python
"""
|
|
Prompt Scan — Command Executor Plugin
|
|
Author: mohelobeid (https://github.com/mohelobeid)
|
|
|
|
WARNING: This plugin is EXTREMELY DANGEROUS and intentionally vulnerable.
|
|
LLM07: Insecure Plugin Design | LLM08: Excessive Agency
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
import platform
|
|
import subprocess
|
|
|
|
|
|
def execute_command(command: str) -> dict:
|
|
"""Execute an arbitrary OS command. LLM07/LLM08: shell=True, no whitelist."""
|
|
try:
|
|
result = subprocess.run(command, shell=True, capture_output=True, text=True, timeout=30)
|
|
return {"success": True, "command": command, "stdout": result.stdout,
|
|
"stderr": result.stderr, "return_code": result.returncode, "cwd": os.getcwd()}
|
|
except subprocess.TimeoutExpired:
|
|
return {"success": False, "error": "Command timeout", "command": command}
|
|
except Exception as exc: # pylint: disable=broad-exception-caught
|
|
return {"success": False, "error": str(exc), "command": command}
|
|
|
|
|
|
def execute_python_code(code: str) -> dict:
|
|
"""Execute arbitrary Python via exec(). LLM07/LLM08: no sandboxing."""
|
|
try:
|
|
exec_globals: dict = {}
|
|
exec(code, exec_globals) # noqa: S102
|
|
return {"success": True, "code": code, "globals": str(exec_globals)}
|
|
except Exception as exc: # pylint: disable=broad-exception-caught
|
|
return {"success": False, "error": str(exc), "code": code}
|
|
|
|
|
|
def get_environment_variables() -> dict:
|
|
"""Return all environment variables — LLM06."""
|
|
return {"success": True, "env_vars": dict(os.environ)}
|
|
|
|
|
|
def get_system_info() -> dict:
|
|
"""Return system platform details — LLM06."""
|
|
return {
|
|
"success": True, "system": platform.system(), "release": platform.release(),
|
|
"python_version": platform.python_version(), "cwd": os.getcwd(),
|
|
"user": os.getenv("USER") or os.getenv("USERNAME"),
|
|
}
|