T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/init-council.sh:94
- Finding
- Path Traversal and Configuration Injection Through Unvalidated Agent Names<![CDATA[ ## Vulnerability Details **File Location**: `scripts/init-council.sh:94-169` **Vulnerability Type**: Path traversal and unsafe JSON generation **Risk Level**: Medium ### Vulnerable Code ```bash # Create each agent's directory structure for AGENT in "$@"; do AGENT_DIR="$WORKSPACE/agents/$AGENT" mkdir -p "$AGENT_DIR/memory" mkdir -p "$AGENT_DIR/.learnings" mkdir -p "$AGENT_DIR/scripts" mkdir -p "$AGENT_DIR/hooks" mkdir -p "$AGENT_DIR/references" mkdir -p "$AGENT_DIR/data" # Initialize gotchas.md if [ ! -f "$AGENT_DIR/gotchas.md" ]; then cat > "$AGENT_DIR/gotchas.md" << EOF # Gotchas — $AGENT Known pitfalls. Read this before major tasks. --- <!-- Add gotchas as they surface. Format: ## Title / What goes wrong / The fix --> EOF fi # Initialize config.json if [ ! -f "$AGENT_DIR/config.json" ]; then cat > "$AGENT_DIR/config.json" << EOF { "agent_name": "$AGENT", "setup_complete": false, "preferences": {}, "api_keys_ref": [], "custom_settings": {} } EOF fi ``` ### Technical Analysis The script accepts agent names from positional command-line arguments and uses them directly to construct filesystem paths. Shell quoting prevents ordinary shell command injection, but it does not prevent path traversal. An agent name containing components such as `../` can cause `AGENT_DIR` to resolve outside the intended `workspace/agents/` directory. The script then creates directories and predictable Markdown and JSON files at that escaped location. The agent name is also interpolated directly into a JSON string. Names containing double quotes, backslashes, control characters, or newlines can produce malformed JSON or inject additional JSON properties. The same value is inserted into generated Markdown without validation. The `-f` checks reduce the ability to overwrite existing regular files, but they do not prevent directory creation or the placement of new files outside the expecte ...[truncated 1360 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict agent names to a conservative identifier format, for example: ```bash if [[ ! "$AGENT" =~ ^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$ ]]; then printf 'Invalid agent name: %q\n' "$AGENT" >&2 exit 1 fi ``` 2. Explicitly reject path separators, `.` and `..` components, control characters, and leading hyphens. 3. Canonicalize the workspace and proposed destination, then verify that the destination remains under the canonical `workspace/agents/` directory. 4. Reject symbolic-link components or use directory-relative, no-follow filesystem operations where available. 5. Generate JSON through a JSON-aware utility or language library rather than direct heredoc interpolation. For example, use Python's `json.dump` with the agent name passed as data. 6. Validate the workspace path before creating files and avoid operating on unexpected symlinked workspace directories. 7. Add tests covering traversal strings, quotes, backslashes, newlines, Unicode control characters, duplicate names, and excessively long names. ]]>