T09 · Insecure Skill Coding Practices
- Location
SKILL.md:26- Finding
Automatic Opening of Untrusted Files Through OS-Associated Applications
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 26-35
Vulnerability Type: Unsafe processing of untrusted files
Risk Level: MediumVulnerable Code Snippet
markdown ### 第一步：获取待处理队列 1. 使用终端工具列出目标文件夹（默认 `~/Downloads`）中的所有文件。 2. 自动过滤并跳过系统隐藏文件（如 `.DS_Store`）和正在下载的临时文件（如 `.crdownload`, `.part`）。 ### 第二步：模拟人类视觉阅读（核心循环） 针对队列中的每一个文件，严格执行以下动作： 1. **打开文件：** 使用操作系统的默认程序或命令（如 Mac 的 `open`，Windows 的 `start`）打开该文件。 2. **视觉抓取：** 等待 1-2 秒确保软件 UI 渲染完成。使用你的**屏幕视觉能力 (Computer Use - Vision)** 截取当前屏幕，阅读并理解文件内容。 3. **内容提炼：** 在后台分析该文件是什么（如：餐饮发票、租房合同、搞笑表情包、技术 PDF）。提取关键元数据（如发票日期、公司名称、主要内容）。 4. **关闭窗口：** 模拟按下关闭快捷键（如 `Cmd+W` 或 `Alt+F4`），退出预览界面。Technical Analysis
The workflow enumerates all files in a user-controlled Downloads or Desktop directory and instructs the agent to open each file with the operating system's default application. Its filtering only excludes hidden files and incomplete downloads; it does not reject executable files, scripts, shortcuts, disk images, macro-enabled documents, protocol-handler files, or other active content.
Invoking commands such as
openorstartdelegates processing to the registered OS handler. Depending on the file type and platform configuration, this can launch an executable, invoke an interpreter, trigger a protocol handler, mount attacker-controlled content, or expose a vulnerable associated application to malicious input. Merely closing the resulting window afterward does not mitigate actions that occur while the file is opened.Attack Path
- An attacker causes a malicious or specially crafted file to be placed in the victim's Downloads or Desktop directory.
- The user asks the skill to organize that directory.
- The skill includes the malicious file because it only excludes hidden and partial-download files.
- The skill invokes the operating system's default handler through
open,start, or an equivalent command. - The file executes direc ...[truncated 660 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace OS-level opening with non-executing, format-specific metadata extraction or sandboxed preview generation.
- Enforce an allowlist of passive file formats that are safe to inspect.
- Explicitly reject executables, scripts, shortcuts, disk images, macro-enabled documents, installer packages, and protocol-handler files.
- Resolve and validate symlinks before processing so files outside the intended directories cannot be opened indirectly.
- Inspect file signatures rather than trusting extensions alone.
- Disable macros, embedded scripts, external resource loading, and network access in document-rendering components.
- Run parsers or previewers in a restricted sandbox with minimal filesystem access, no shell execution, and no unnecessary network access.
- Require explicit user confirmation before opening any file through an OS-associated application.
- Record skipped active-content files for manual review rather than opening or moving them automatically.