T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/assemble_send_instruction.py:10- Finding
Predictable Temporary Log Exposes Sensitive File Metadata and Permits Symlink Abuse
- Content
View full analysis
Vulnerability Details
File Location:
scripts/assemble_send_instruction.py, lines 10-24, 38-42, 76-77, and 94-99
Vulnerability Type: Insecure temporary-file handling and plaintext sensitive-data logging
Risk Level: MediumVulnerable Code
python LOG_FILE = "/tmp/yunjia-file-transfer.log" def log(message): """Print log with timestamp to stderr and log file""" timestamp = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S") log_line = f"[{timestamp}] [yunjia-file-transfer] {message}" # Print to stderr print(log_line, file=sys.stderr) # Append to log file try: with open(LOG_FILE, "a") as f: f.write(log_line + "\n") except Exception: pass # Ignore file write errorsSensitive values are passed to that logging function at several locations:
python if text: log(f" Text: {text}") for i, path in enumerate(file_paths, 1): log(f" File {i}: {path}")python log(f"Arguments received: {args.file}, text: {args.text}")python output = json.dumps(result, ensure_ascii=False, indent=2) log(f"Output to stdout: {output}")Technical Analysis
Every invocation records the complete local file paths, user-provided message text, command-line arguments, and generated transfer instruction in a fixed file named
/tmp/yunjia-file-transfer.log.A globally predictable path under
/tmpis unsafe because the script does not:- Create the file atomically with restrictive permissions.
- Verify that the destination is a regular file owned by the current user.
- prevent following symbolic links.
- Restrict the file mode to the owner, such as
0600. - Redact file names, directory structures, or user message content.
- Sanitize carriage returns or newlines before creating log records.
Depending on the host's umask and existing file ownershi ...[truncated 2244 chars]
- Remediation
View remediation
Remediation Suggestions
- Disable persistent logging by default and avoid recording full file paths, user text, command-line arguments, or complete output.
- If diagnostic logging is necessary, make it explicitly opt-in and redact sensitive values. Record only non-sensitive operational events, such as the number of files processed and a generic success or failure result.
- Store logs in a platform-specific, user-private state directory rather than a shared temporary directory.
- Create the log atomically with owner-only permissions, such as mode
0600, using secure low-level file-opening flags. - Prevent symbolic-link traversal by using
O_NOFOLLOWwhere supported, and verify withfstat()that the opened destination is a regular file owned by the current user. - Sanitize carriage returns, newline characters, and other control characters before writing any user-controlled value.
- Add size limits, rotation, and a defined retention period to prevent indefinite accumulation of sensitive metadata.
- Do not silently suppress every logging exception. Handle failures safely without exposing sensitive details, and make security-relevant setup errors observable through non-sensitive diagnostics.
- Add automated tests covering restrictive permissions, pre-existing symbolic links, newline injection, redaction, and concurrent file creation.