Security checks for vulnerabilities and agentic risk
Overview
The skill is a plausible Gantt chart generator, but its output option can overwrite any file the process can write, despite implying workspace-scoped output.
Review before installing or using this skill. Run it only in a constrained workspace, provide explicit safe output paths, and avoid passing paths influenced by untrusted data until output path validation is added.
File Location: scripts/main.py, lines 164–166 Vulnerability Type: Unrestricted file write and arbitrary file overwrite Risk Level: Medium
Vulnerable Code:
python
if args.output:
with open(args.output, 'w') as f:
f.write(chart)
Technical Analysis
The --output argument is passed directly to open() in truncating write mode without canonicalizing the path, restricting it to an approved workspace, rejecting path traversal, checking for symbolic links, or controlling whether an existing file may be replaced.
Consequently, absolute paths, parent-directory traversal sequences such as ../, and symbolic-link paths are accepted. Python's 'w' mode truncates an existing destination before writing the generated chart. The operation remains limited by the operating-system permissions of the process, but it can replace any file writable by that process.
Attack Path
An attacker or untrusted workflow gains influence over the command-line arguments supplied to the skill.
The attacker supplies an output path targeting a writable file, for example:
bash
An absolute path or a path referencing a symbolic link can be used similarly.
The script accepts the path without validation.
open(args.output, 'w') resolves the supplied path and truncates the destination.
The generated chart content is written over the target file.
Impact Assessment
Exploitation grants no privileges beyond those already held by the executing process. Within those privileges, an attacker can corrupt or replace project files, application data, and user configuration files. If the skill is run under an elevated or broadly privileged account, the overwrite scope expands to additional sensitive files writable by that account. The exact consequences depend on the selected target and may
...[truncated 109 chars]
Remediation
View remediation
Remediation Suggestions
Define a dedicated, least-privileged output directory under the project workspace.
Resolve both the approved directory and requested destination with pathlib.Path.resolve().
Verify that the resolved destination is a descendant of the approved directory, preferably with Path.is_relative_to() on supported Python versions.
Reject absolute paths, traversal outside the approved directory, and destinations involving symbolic links.
If replacement is not required, create files in exclusive mode ('x') to prevent silent overwrites.
If replacement is required, write to a securely created temporary file in the same approved directory and atomically replace the destination after validation.
Run the skill with minimal filesystem permissions and return a controlled error when validation fails.
The skill advertises file-writing behavior via its documented output generation, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where consumers or enforcement systems cannot clearly constrain what filesystem operations are intended, increasing the risk of unintended or overly broad file writes.
