T09 · Insecure Skill Coding Practices
- Location
SKILL.md:42- Finding
Predictable Temporary Files Expose Sensitive Inventory and Permit File Manipulation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 42-65, 96, and 135-179
Vulnerability Type: Unsafe temporary-file handling and insecure storage of sensitive data
Risk Level: MediumVulnerable Code
The technology inventory is written to a fixed path in the shared temporary directory:
bash cat > /tmp/tech-stack.json << 'EOF' { "stack_name": "production-infrastructure", "last_updated": "2026-07-04", "products": [ {"name": "nginx", "version": "1.24.0", "category": "web-server"}, {"name": "postgresql", "version": "15.3", "category": "database"}, {"name": "redis", "version": "7.0.11", "category": "cache"}, {"name": "nodejs", "version": "20.11.0", "category": "runtime"}, {"name": "openssl", "version": "3.0.8", "category": "crypto"}, {"name": "kubernetes", "version": "1.28.0", "category": "orchestration"}, {"name": "docker", "version": "24.0.5", "category": "container"}, {"name": "python", "version": "3.11.4", "category": "runtime"}, {"name": "gitlab", "version": "16.8.0", "category": "devops"}, {"name": "haproxy", "version": "2.8.1", "category": "load-balancer"} ], "watchlist": [ "openssl", "nginx", "postgresql", "kubernetes", "docker" ], "ignore_cve": [] } EOFThe bulk scan then relies on that predictable path:
bash STACK_FILE="/tmp/tech-stack.json"Report intermediates also use fixed, reusable filenames:
bash }' >> "$REPORT_DIR/tmp-findings.jsonl"bash if [ -f "$REPORT_DIR/tmp-findings.jsonl" ]; thenbash jq -s 'sort_by( (if .kev == true then 0 else 1 end), (if .cvss then -.cvss else 999 end) )' "$REPORT_DIR/tmp-findings.jsonl" > "$REPORT_FILE.tmp"bash rm -f "$REPORT_DIR/tmp-findings.jsonl" "$REPORT_FILE.tmp"Technical Analysis
The Skill explicitly identifies the technology-stack inventory as sensitive, but instructs users ...[truncated 3516 chars]
- Remediation
View remediation
Remediation Suggestions
-
Store the technology inventory in a private, user-owned configuration directory rather than a shared
/tmppathname:bash CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/cve-tracker" umask 077 mkdir -p -m 700 "$CONFIG_DIR" STACK_FILE="$CONFIG_DIR/tech-stack.json" -
Create sensitive files atomically with owner-only permissions. Refuse to overwrite existing symbolic links and use a temporary file followed by an atomic rename:
bash umask 077 tmp_stack=$(mktemp "$CONFIG_DIR/tech-stack.json.XXXXXX") || exit 1 trap 'rm -f "$tmp_stack"' EXIT # Write and validate the JSON in "$tmp_stack". mv -- "$tmp_stack" "$STACK_FILE" trap - EXIT chmod 600 "$STACK_FILE" -
Create a unique private working directory for each scan:
bash umask 077 WORK_DIR=$(mktemp -d "${TMPDIR:-/tmp}/cve-tracker.XXXXXX") || exit 1 trap 'rm -rf -- "$WORK_DIR"' EXIT FINDINGS_FILE="$WORK_DIR/findings.jsonl" REPORT_TMP="$WORK_DIR/report.json" -
Replace every reference to fixed
tmp-findings.jsonland$REPORT_FILE.tmpnames with the unique per-run paths. -
Initialize the findings file with exclusive, non-appending semantics. Do not reuse data from previous runs.
-
Validate the inventory before scanning:
bash jq -e ' type == "object" and (.products | type == "array") and all(.products[]; (.name | type == "string") and (.version | type == "string")) ' "$STACK_FILE" >/dev/null || exit 1 -
Use atomic replacement for the final report and ensure the report directory is owned by the invoking user and not writable by other users.
-
Add error handling such as
set -euo pipefail, verifycurlfailures with--fail, and preserve cleanup traps so interrupted scans cannot leave sensitive intermediate data behind.
-