T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:108
- Finding
- Unsanitized Path Components Permit Filesystem Traversal## Vulnerability Details **File Location**: `SKILL.md`, lines 108–128, 239–265, 448–449, and 544–548 **Vulnerability Type**: Path traversal and unsafe shell path handling **Risk Level**: Medium ### Vulnerable Code ```bash CATEGORY="wechat" SLUG="scan-login" ID="${CATEGORY}-${SLUG}" FILE_PATH="$BP_DIR/$CATEGORY/$SLUG.md" DATE=$(date +%Y-%m-%d) mkdir -p "$BP_DIR/$CATEGORY" ``` The generated path is subsequently used by read, copy, and delete operations: ```bash FILE_PATH="$BP_DIR/{category}/{slug}.md" cat "$FILE_PATH" ``` ```bash mkdir -p docs/references cp "$FILE_PATH" "docs/references/{id}.md" echo "Copied to docs/references/{id}.md" ``` ```bash FILE_PATH="$BP_DIR/{category}/{slug}.md" cat "$FILE_PATH" ``` ```bash rm "$BP_DIR/{category}/{slug}.md" if [ -z "$(ls -A $BP_DIR/{category})" ]; then rmdir "$BP_DIR/{category}" fi ``` ### Technical Analysis The Skill constructs filesystem paths from category, slug, ID, and index-derived values without specifying validation requirements or verifying that the canonical destination remains within `$HOME/.inspirai/best-practices/`. If an attacker can influence a category, slug, ID, or `index.json` file entry, traversal sequences such as `../` may cause the resulting path to resolve outside the intended data directory. Absolute paths, control characters, leading hyphens, whitespace, wildcard characters, and other shell-significant input are likewise not explicitly rejected. Most shown variable expansions are quoted, which limits direct shell command injection. However, this does not prevent path traversal. In addition, the following expansion is unquoted: ```bash ls -A $BP_DIR/{category} ``` This permits shell word splitting and pathname expansion if the substituted category contains whitespace or glob characters. ### Attack Path 1. An attacker supplies a malicious category or slug during capture, or modifies an entry in t ...[truncated 1383 chars]
- Remediation
- ## Remediation Suggestions 1. Apply a strict allowlist to categories, slugs, and IDs, such as: ```text ^[a-z0-9][a-z0-9-]{0,63}$ ``` 2. Reject values containing path separators, `..`, absolute-path syntax, null bytes, control characters, whitespace, wildcard characters, or leading hyphens. 3. Do not trust the `file` property in `index.json`. Reconstruct paths only from independently validated identifiers. 4. Resolve every target to a canonical absolute path and verify that it remains below the canonical `$BP_DIR` path before reading, writing, copying, or deleting it. 5. Quote every shell variable expansion, including the directory passed to `ls`. 6. Add `--` before path operands where supported: ```bash cat -- "$FILE_PATH" cp -- "$FILE_PATH" "$DESTINATION" rm -- "$FILE_PATH" rmdir -- "$CATEGORY_DIR" ``` 7. Refuse deletion when the resolved path is equal to `$BP_DIR`, `$HOME`, the project root, or any other protected directory. 8. Prefer structured filesystem APIs over interpolated shell commands. 9. Add tests covering traversal strings, absolute paths, whitespace, wildcard characters, symbolic links, and malicious index entries.