T09 · Insecure Skill Coding Practices
Warning
- Location
add-tags.py:63- Finding
Symbolic-Link Following Allows Modification of Files Outside the Target Directory in add-tags.py
- Content
View full analysis
\n" if dry_run: print(f" WOULD ADD: {tag_line.strip()}") return True, "dry run" with open(filepath, 'w', encoding='utf-8') as f: f.write(tag_line + content) ``` ### Technical Analysis The script obtains Markdown filenames from a user-supplied directory and opens each resulting path without checking whether the directory entry is a symbolic link. Python's `open()` follows symbolic links by default. Consequently, an attacker who can create entries in the target directory can place a `.md` symbolic link pointing to another user-writable file outside that directory. The script reads the linked target and then reopens it in write mode, which truncates and replaces the target with a generated tag line followed by its previous content. The generated tag can also contain content derived from the symbolic-link filename. Although the current filename filtering limits entries to names ending in `.md`, the primary security issue is the unauthorized cross-directory write. ### Attack Path 1. The attacker obtains write access to a memory projects directory that will be processed. 2. The attacker creates a symbolic link with a `.md` suffix in that directory: ```bash ln -s "$HOME/path/to/target.md" /path/to/memory/projects/attacker.md ``` 3. The victim or Agent runs: ```bash python3 add-tags.py /path/to/m ...[truncated 736 chars]- Remediation
View remediation