T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/init-council.sh:94- Finding
Path Traversal and Configuration Injection Through Unvalidated Agent Names
- Content
View full analysis
"$AGENT_DIR/gotchas.md" << EOF # Gotchas — $AGENT Known pitfalls. Read this before major tasks. --- EOF fi # Initialize config.json if [ ! -f "$AGENT_DIR/config.json" ]; then cat > "$AGENT_DIR/config.json" << EOF { "agent_name": "$AGENT", "setup_complete": false, "preferences": {}, "api_keys_ref": [], "custom_settings": {} } EOF fi ``` ### Technical Analysis The script accepts agent names from positional command-line arguments and uses them directly to construct filesystem paths. Shell quoting prevents ordinary shell command injection, but it does not prevent path traversal. An agent name containing components such as `../` can cause `AGENT_DIR` to resolve outside the intended `workspace/agents/` directory. The script then creates directories and predictable Markdown and JSON files at that escaped location. The agent name is also interpolated directly into a JSON string. Names containing double quotes, backslashes, control characters, or newlines can produce malformed JSON or inject additional JSON properties. The same value is inserted into generated Markdown without validation. The `-f` checks reduce the ability to overwrite existing regular files, but they do not prevent directory creation or the placement of new files outside the expecte ...[truncated 1360 chars]- Remediation
View remediation
&2 exit 1 fi ``` 2. Explicitly reject path separators, `.` and `..` components, control characters, and leading hyphens. 3. Canonicalize the workspace and proposed destination, then verify that the destination remains under the canonical `workspace/agents/` directory. 4. Reject symbolic-link components or use directory-relative, no-follow filesystem operations where available. 5. Generate JSON through a JSON-aware utility or language library rather than direct heredoc interpolation. For example, use Python's `json.dump` with the agent name passed as data. 6. Validate the workspace path before creating files and avoid operating on unexpected symlinked workspace directories. 7. Add tests covering traversal strings, quotes, backslashes, newlines, Unicode control characters, duplicate names, and excessively long names. ]]>