T09 · Insecure Skill Coding Practices
- Location
SKILL.md:76- Finding
User-Controlled Slug Allows Path Traversal Outside the Concept Directory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:62-67, 76-82, 132-155, 199
Vulnerability Type: Path traversal through an insufficiently validated user-controlled path component
Risk Level: MediumVulnerable Code Snippets
markdown All artifacts for a concept live under `.beagle/concepts/<slug>/`: ```text .beagle/concepts/<slug>/ ├── prfaq.md ├── brief.md ├── research/ └── analysis/text ```markdown At end of Ignition, propose a slug derived from the concept headline — lowercase, hyphenated, ≤40 characters, no dates. Present the proposed slug. The user can accept or override with their own string.yaml output_dir: "/abs/path/.beagle/concepts/<slug>/analysis/"yaml output_dir: "/abs/path/.beagle/concepts/<slug>/research/"markdown Create `.beagle/concepts/<slug>/prfaq.md` using the skeleton in `references/prfaq-template.md`.markdown Produce `.beagle/concepts/<slug>/brief.md` per the template in `references/verdict.md`.Technical Analysis
The skill defines a safe-looking slug convention but does not make that convention an enforceable validation rule. It explicitly permits the user to override the slug “with their own string.” The resulting value is interpolated into:
- Paths checked during workflow resumption
- The artifact-analysis output directory
- The web-research output directory
- The
prfaq.mddestination - The
brief.mddestination - Directories subject to companion refresh and archival behavior
If an override contains path separators or traversal components such as
../, filesystem path resolution may escape.beagle/concepts/. For example, a slug resembling../../../../tmp/targetwould cause the generated paths to resolve outside the intended concept workspace.The documented lowercase, hyphenated, 40-character convention does not mitigate this issue because the skill does not instruct the agent to reject nonconforming overrides or verify the canonical destination path befo ...[truncated 1683 chars]
- Remediation
View remediation
Remediation Suggestions
-
Treat the slug format as a mandatory validation rule rather than a convention.
-
Reject every user override that does not match a strict allowlist such as:
regex ^[a-z0-9]+(?:-[a-z0-9]+)*$ -
Enforce the documented maximum length of 40 characters after normalization.
-
Explicitly reject:
/and\.and..path components- Absolute paths
- URL-encoded or Unicode-equivalent path separators
- Control characters and null bytes
-
Construct paths using a safe path-joining API rather than string concatenation.
-
Canonicalize both the concept root and every derived destination before each read or write.
-
Verify that every canonical destination remains a descendant of the canonical
.beagle/concepts/directory. -
Apply the same containment check to companion
output_dirvalues and archive destinations. -
Do not perform resume reads until the slug has passed validation and containment checks.
-
If the user supplies an invalid override, refuse it and request a conforming lowercase, hyphenated slug rather than attempting to sanitize ambiguous traversal input.
A safe invariant should be enforced before every filesystem operation:
text canonical_destination starts with canonical_concepts_root + path_separatorThe root itself should not be accepted as a concept destination.
-