T09 · Insecure Skill Coding Practices
Warning
- Location
modules/ai-generated-bloat.md:64- Finding
Predictable temporary package inventory file permits symbolic-link clobbering
- Content
View full analysis
/tmp/installed.txt grep -rh "^import \|^from " --include="*.py" . | \ sed 's/^import //;s/^from //;s/ import.*//' | \ sort -u | while read pkg; do root=$(echo $pkg | cut -d. -f1) grep -q "^$root" /tmp/installed.txt || echo "HALLUCINATED?: $pkg" done ``` ### Technical Analysis The command writes package inventory data to the fixed, publicly predictable path `/tmp/installed.txt`. Shell redirection opens this path with truncation and ordinarily follows symbolic links. On a shared system, another local user can create `/tmp/installed.txt` as a symbolic link to another file writable by the account running the Skill. When the analysis command is executed, `pip freeze` can truncate and replace the target's contents. Concurrent Skill runs can also overwrite each other's package inventories, causing incorrect dependency findings and exposing environment package metadata to other local processes. Exploitation requires local access sufficient to create entries in the shared temporary directory and a target file writable by the victim account. ### Attack Path 1. An attacker predicts that the Skill will use `/tmp/installed.txt`. 2. The attacker creates a symbolic link at that path pointing to a file writable by the victim. 3. The victim runs the hallucinated-dependency analysis. 4. Shell redirection follows the symbolic link and truncates the target. 5. The output of `pip freeze` is written into the target file. 6. Subsequent package checks consume attacker-influenced or corrupted temporary data. ### Impact Assessment The attacker does not gain privileges beyond those of the invoking account. However, the vulnerability can overwrite or corrupt any file that the invoking ...[truncated 209 chars]- Remediation
View remediation
"$installed_file" grep -rh "^import \|^from " --include="*.py" . | \ sed 's/^import //;s/^from //;s/ import.*//' | \ sort -u | while IFS= read -r pkg; do root=$(printf '%s\n' "$pkg" | cut -d. -f1) grep -q -- "^$root" "$installed_file" || printf 'HALLUCINATED?: %s\n' "$pkg" done ``` Additional hardening should include: - Never use fixed names in a shared temporary directory. - Apply `umask 077` so other users cannot read generated metadata. - Quote all path and variable expansions. - Use a cleanup trap so temporary data is removed on normal exit and interruption. ]]>