T09 · Insecure Skill Coding Practices
- Location
SKILL.md:130- Finding
Predictable Temporary File Enables Symlink Attacks and Cross-Run Data Exposure
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 130–131
Vulnerability Type: Predictable and insecure temporary-file handling
Risk Level: MediumVulnerable code:
bash 1. **Write markdown to temp file** — `cat > /tmp/doc_name.md << 'EOF'` 2. **Create doc** — `gog docs create "Title" --file /tmp/doc_name.md --parent FOLDER_ID --pageless --force --no-input`Technical Analysis
The workflow writes document content to the fixed, globally predictable path
/tmp/doc_name.md. It neither creates the file atomically nor verifies that the path is a regular file owned by the current process. It also provides no isolation between concurrent executions.On a shared host, a local attacker or another process operating under the same account could pre-create this path as a symbolic link. Shell redirection would then follow the link and overwrite its target, subject to the executing account's filesystem permissions and operating-system symlink protections. An attacker could also replace or modify the temporary file between its creation and the subsequent
gog docs createcommand, causing attacker-controlled content to be uploaded.Concurrent legitimate executions can overwrite the same file, resulting in one user's document being uploaded by another run. Because the Markdown may contain confidential report data, this creates both integrity and confidentiality risks.
Attack Path
- An attacker with local access capable of manipulating
/tmp/doc_name.mdpredicts the documented filename. - Before the skill runs, the attacker creates
/tmp/doc_name.mdas a symbolic link to a file writable by the skill's operating-system account, or creates a file that can subsequently be replaced. - The skill executes the documented shell redirection.
- If symlink protections do not block the operation, the shell follows the link and overwrites the target file with the generated Markdown.
- Alternative ...[truncated 1042 chars]
- An attacker with local access capable of manipulating
- Remediation
View remediation
Remediation Suggestions
Replace the fixed path with a private, unpredictable temporary directory and ensure cleanup occurs even if a command fails:
bash tmp_dir="$(mktemp -d)" || exit 1 chmod 700 "$tmp_dir" trap 'rm -rf -- "$tmp_dir"' EXIT HUP INT TERM source_file="$tmp_dir/source.md" umask 077 cat > "$source_file" << 'EOF' # Document content EOF gog docs create "Title" \ --file "$source_file" \ --parent "$FOLDER_ID" \ --pageless \ --force \ --no-inputAdditional hardening measures:
- Never use a constant filename directly under a shared temporary directory.
- Quote every temporary path and variable expansion.
- Set
umask 077so generated files are readable and writable only by the executing account. - Validate that the temporary file is a regular file owned by the current user before uploading it.
- Keep the file descriptor or isolated temporary directory under process control throughout the workflow.
- Remove temporary content through a shell cleanup trap on both normal and abnormal termination.
- Use a distinct temporary directory for every invocation to prevent interference between concurrent runs.