T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/setup.sh:195
- Finding
- Predictable Temporary File Allows Symlink-Based File Clobbering<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh`, lines 195-202 **Vulnerability Type**: Unsafe predictable temporary file **Risk Level**: Medium ### Vulnerable Code ```bash crontab -l 2>/dev/null | grep -v 'claude-watchdog' | grep -v 'status-check\.py' | grep -v 'latency-probe\.py' > /tmp/crontab-clean || true { cat /tmp/crontab-clean echo "*/15 * * * * $PYTHON3 $STATUS_SCRIPT >> /dev/null 2>&1 # claude-watchdog" echo "*/15 * * * * $PYTHON3 $LATENCY_SCRIPT >> /dev/null 2>&1 # claude-watchdog" } | crontab - rm -f /tmp/crontab-clean ``` ### Technical Analysis The setup script uses the fixed, globally predictable path `/tmp/crontab-clean`. Shell redirection opens this path with truncation before writing the filtered crontab. The script does not securely create the file, verify its ownership or type, or prevent symbolic-link traversal. On systems without effective temporary-directory symlink protections, another local process can create `/tmp/crontab-clean` as a symbolic link to a file writable by the user who later runs the setup script. The redirection can then truncate and overwrite the linked file. The linked file's resulting contents are subsequently passed to `crontab`, potentially adding unintended content to the user's scheduled tasks. Some Linux configurations mitigate this through protected symlink and protected regular-file settings, but the implementation remains unsafe and non-portable. ### Attack Path 1. A local attacker predicts that the victim will run `scripts/setup.sh`. 2. The attacker creates `/tmp/crontab-clean` as a symbolic link to a file that the victim can modify. 3. The victim runs the setup script. 4. Shell redirection follows the symbolic link and truncates the target file. 5. Filtered crontab data is written to the target. 6. The script reads the same path and submits its contents to `crontab`. 7. Depending on the chosen target and its existing content, this causes file corruption and may intr ...[truncated 484 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Avoid filesystem-backed temporary storage where possible. Build the replacement crontab through a pipeline or shell variable and submit it directly. If a temporary file is necessary: 1. Create it with `mktemp`. 2. Install an `EXIT` trap to remove it. 3. Ensure it is owned by the current user and has mode `0600`. 4. Do not reuse a predictable filename. Example: ```bash tmp_crontab="$(mktemp "${TMPDIR:-/tmp}/claude-watchdog.XXXXXX")" trap 'rm -f "$tmp_crontab"' EXIT chmod 600 "$tmp_crontab" crontab -l 2>/dev/null | grep -v 'claude-watchdog' > "$tmp_crontab" || true { cat "$tmp_crontab" # Add securely generated Skill-owned entries here. } | crontab - ``` The preferred design is to manage an exactly delimited cron block and avoid broad filtering, as described in the next finding. ]]>