T09 · Insecure Skill Coding Practices
Error
- Location
scripts/build_dashboard_bundle.py:2683- Finding
Arbitrary Output Directory Cleanup Can Delete Unrelated Files
- Content
View full analysis
None: for folder_name in ["png", "excel", "ppt"]: folder = output_dir / folder_name if folder.exists(): shutil.rmtree(folder) for file_path in output_dir.iterdir() if output_dir.exists() else []: if file_path.is_file() and file_path.name != "dashboard.html": file_path.unlink() ``` The cleanup function is invoked against the resolved command-line path before workbook validation: ```python def main() -> None: args = parse_args() output_dir = Path(args.output_dir).resolve() output_dir.mkdir(parents=True, exist_ok=True) cleanup_output_dir(output_dir) ``` It is invoked again after generating the HTML: ```python build_html(meta, html_path, dashboard1_image, dashboard2_image, d3_df, d4_df, d3_meta, d4_meta, d5_df=d5_df, executive_summary=executive_summary, d1_df=d1_df, d1_meta=d1_meta, d2_df=d2_df, d2_meta=d2_meta) cleanup_output_dir(output_dir) print(html_path) ``` ### Technical Analysis The `--output-dir` argument is fully user-controlled. Although the path is normalized with `resolve()`, the script does not verify that it is a newly created, Skill-owned directory or that it resides within the current workspace. The cleanup operation: - Recursively deletes any `png`, `excel`, or `ppt` directory beneath the selected path. - Deletes every top-level regular file except one named `dashboard.html`. - Runs before validating whether the input workbooks are usable. - Runs again after dashboard generation. - Does not require an ownership marker or explicit confirmation. Path normalization does not provide a security boundary. An absolute path, workspace root, or e ...[truncated 1542 chars]- Remediation
View remediation