T09 · Insecure Skill Coding Practices
- Location
scripts/weekly_archive.sh:18- Finding
Recursive Archive Traversal Can Relocate or Overwrite Historical Records
- Content
View full analysis
Vulnerability Details
File Location:
scripts/weekly_archive.sh, lines 18-22
Vulnerability Type: Unsafe recursive file archival and basename collision
Risk Level: MediumVulnerable Code
bash find "$MEMORY_DIR" -name "*.md" -mtime +7 -type f | while read file; do filename=$(basename "$file") echo " Moving: $filename" mv "$file" "$WEEKLY_DIR/" doneTechnical Analysis
MEMORY_DIRis set to./memory, while the archive directory is created beneath it as./memory/archive. The recursivefindcommand therefore scans both active daily records and existing archive directories.Any archived Markdown file older than seven days can be selected again and moved into the current weekly archive. The script also discards each source file's directory structure by moving it under its basename. If files in different directories share the same basename, they are moved to the same destination path. Depending on the destination state and platform behavior,
mvcan overwrite an existing file without confirmation.The loop also uses line-delimited
readrather than null-delimited paths. Although ordinary date-based logs are unlikely to contain newline characters, crafted filenames containing newlines would be parsed incorrectly.Attack Path
- An attacker or another local process with write access to the project creates or retains Markdown files older than seven days in different
memorysubdirectories. - At least two files are given the same basename, such as:
memory/archive/2026-W01/2026-01-01.mdmemory/archive/2026-W02/2026-01-01.md
- A user or scheduled task runs
scripts/weekly_archive.sh. - The recursive
findcommand selects both previously archived files. - The script moves both files into the current weekly directory as
2026-01-01.md. - One file may replace the other, while records are also removed from their original weekly archives.
This issue requires local write access to the project ...[truncated 715 chars]
- An attacker or another local process with write access to the project creates or retains Markdown files older than seven days in different
- Remediation
View remediation
Remediation Suggestions
Restrict archival candidates to top-level daily records, explicitly exclude the archive tree, use null-delimited paths, and prevent destination overwrites:
bash find "$MEMORY_DIR" \ -maxdepth 1 \ -type f \ -name "????-??-??.md" \ -mtime +7 \ -print0 | while IFS= read -r -d '' file; do filename=$(basename -- "$file") destination="$WEEKLY_DIR/$filename" if [ -e "$destination" ]; then echo "Refusing to overwrite existing archive file: $destination" >&2 continue fi mv -- "$file" "$destination" doneAdditional hardening should include:
- Validate that each source resolves beneath the top-level
memorydirectory and outsidememory/archive. - Use
mv -n --as a secondary overwrite safeguard where supported. - Generate collision-resistant archive names or preserve relevant directory structure.
- Write an archival manifest containing source path, destination path, timestamp, and checksum.
- Test recursive archive scenarios, duplicate basenames, whitespace, and unusual filenames.
- Back up or copy records before deletion if archival data is considered critical.
- If invoked by cron, log failures and collision warnings to a monitored location.
- Validate that each source resolves beneath the top-level