T09 · Insecure Skill Coding Practices
Error
- Location
scripts/upload.sh:4- Finding
Unrestricted Local File Upload to a Remote Service
- Content
View full analysis
}" TOKEN="${INFINIMO_TOKEN:-${INFINIMO_API_KEY:?Set INFINIMO_TOKEN or INFINIMO_API_KEY}}" if [[ ! -f "$FILE" ]]; then echo "Error: file not found: $FILE" >&2 exit 1 fi curl -s -X POST "https://www.clawec.com/api/upload/image" \ -H "Token: $TOKEN" \ -F "file=@${FILE}" \ -F "platform=1" \ -F "terminal=4" \ -F "language=en" ``` The declared restriction appears in `SKILL.md`, lines 103–106: ```markdown Limits (same as web): - `image/*` only - Up to **12** reference images per job ``` ### Technical Analysis The upload script verifies only that the supplied path resolves to a regular file using `[[ -f "$FILE" ]]`. It does not verify: - The file's MIME type or image signature - Whether an image decoder can safely parse the file - The file extension or size - Whether the path is a symbolic link - Whether the resolved path is inside an approved working directory - Whether the user explicitly approved that particular file for upload The `-f` test follows symbolic links. Consequently, a symbolic link to another readable regular file also passes validation. After this minimal check, `curl -F "file=@${FILE}"` reads and transmits the selected file to `https://www.clawec.com/api/upload/image`. Although the documentation states that only images are supported, the client does not enforce that restriction. A server-side rejection would occur only after the client has already transmitted the request body, so it does not eliminate the local disclosure attempt. This behavior exceeds the minimum privilege necessary for reference-image upload because the script can read and submit any regular file accessible to the account running the Skill. ### Attack Path 1. An attacker supplies task content t ...[truncated 1387 chars]- Remediation
View remediation