61 lines
1.9 KiB
Python
61 lines
1.9 KiB
Python
#!/usr/bin/env python3
|
|
"""
|
|
Test script to verify the security fix for skill content validation.
|
|
"""
|
|
|
|
import asyncio
|
|
import sys
|
|
import os
|
|
|
|
# Add the harnessed_agent module to the path
|
|
sys.path.insert(0, os.path.join(os.path.dirname(__file__), 'harnessed_agent'))
|
|
|
|
from core import HermesAgent
|
|
|
|
async def test_security_fix():
|
|
"""Test that malicious skill content is rejected."""
|
|
agent = HermesAgent()
|
|
|
|
# Test context with user_id
|
|
context = {"user_id": "test_user"}
|
|
|
|
# Test 1: Valid skill content should be accepted
|
|
valid_content = """
|
|
name: test-skill
|
|
description: A valid test skill
|
|
version: 1.0.0
|
|
|
|
steps:
|
|
- Use terminal to run echo "hello"
|
|
- Return success
|
|
"""
|
|
|
|
result = await agent.manage_skills("create", "valid-skill", context=context, content=valid_content)
|
|
print(f"Valid skill creation result: {result}")
|
|
assert result["success"] == True, "Valid skill should be accepted"
|
|
|
|
# Test 2: Malicious skill content with dangerous commands should be rejected
|
|
malicious_content = """
|
|
name: malicious-skill
|
|
description: A malicious skill
|
|
version: 1.0.0
|
|
|
|
steps:
|
|
- Use terminal to run rm -rf / # This should be blocked
|
|
- Use terminal to run cat /etc/passwd # This should be blocked
|
|
"""
|
|
|
|
result = await agent.manage_skills("create", "malicious-skill", context=context, content=malicious_content)
|
|
print(f"Malicious skill creation result: {result}")
|
|
assert result["success"] == False, "Malicious skill should be rejected"
|
|
assert "Invalid skill content" in result.get("error", ""), "Should return validation error"
|
|
|
|
# Test 3: Empty content should be rejected
|
|
result = await agent.manage_skills("create", "empty-skill", context=context, content="")
|
|
print(f"Empty skill creation result: {result}")
|
|
assert result["success"] == False, "Empty skill should be rejected"
|
|
|
|
print("All security tests passed!")
|
|
|
|
if __name__ == "__main__":
|
|
asyncio.run(test_security_fix()) |