T09 · Insecure Skill Coding Practices
Note
- Location
- scripts/clawhub_preflight.sh:35
- Finding
- Predictable Shared Temporary Files Permit Symlink Attacks and Cross-Run Interference<![CDATA[ ## Vulnerability Details **File Location**: `scripts/clawhub_preflight.sh:35-40`; `scripts/clawhub_publish_safe.sh:35-38` **Vulnerability Type**: Predictable temporary-file creation in a shared directory **Risk Level**: Low ### Vulnerable Code `scripts/clawhub_preflight.sh:35-40`: ```bash if command -v clawhub >/dev/null 2>&1; then if clawhub whoami >/tmp/clawhub_whoami.txt 2>/tmp/clawhub_whoami.err; then ok "authenticated with clawhub" else warn "not authenticated. Run: clawhub login --token <clh_token>" fi fi ``` `scripts/clawhub_publish_safe.sh:35-38`: ```bash if ! clawhub whoami >/tmp/clawhub_publish_whoami.out 2>/tmp/clawhub_publish_whoami.err; then echo "ERROR: Not logged in. Run: clawhub login --token <clh_token>" >&2 exit 4 fi ``` ### Technical Analysis Both scripts redirect command output to fixed, predictable filenames under the globally shared `/tmp` directory. Shell redirection opens and truncates these paths before executing `clawhub whoami`. A local user who can anticipate execution may create one of these paths as a symbolic link to another file writable by the victim. If operating-system symlink protections do not block the operation, the redirection follows the link and truncates or overwrites the target. Fixed names also allow concurrent invocations and different users to interfere with one another or consume stale output. The scripts only need the exit status of `clawhub whoami`; retaining its output in persistent shared files is unnecessary. ### Attack Path 1. A local attacker determines that a victim will run one of the scripts. 2. The attacker creates a predictable path, such as `/tmp/clawhub_whoami.txt`, as a symbolic link to a file writable by the victim. 3. The victim executes the script. 4. The shell processes the output redirection before starting `clawhub whoami`. 5. On a system where symlink protections do not prevent it, the linked target is truncated and receives the command output. 6. Alter ...[truncated 791 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Because only the exit status is required, discard both output streams rather than writing files: ```bash if clawhub whoami >/dev/null 2>&1; then ok "authenticated with clawhub" else warn "not authenticated. Run: clawhub login --token <clh_token>" fi ``` Apply the same change to `clawhub_publish_safe.sh`. If diagnostic output must be retained: 1. Create a private temporary directory with `mktemp -d`. 2. Set a restrictive `umask`, such as `umask 077`. 3. Register a cleanup trap. 4. Store all diagnostic files inside the private directory. 5. Do not reuse fixed paths across executions. Example: ```bash umask 077 TMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/clawhub.XXXXXX")" trap 'rm -rf -- "$TMP_DIR"' EXIT if ! clawhub whoami >"$TMP_DIR/whoami.out" 2>"$TMP_DIR/whoami.err"; then echo "ERROR: Not logged in. Run: clawhub login --token <clh_token>" >&2 exit 4 fi ``` ]]>