T09 · Insecure Skill Coding Practices
- Location
SKILL.md:61- Finding
Unsanitized Domain Name Used in Archive File Paths
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:61, 68-69, 93; supporting behavior indomains/README.md:3-5, 9
Vulnerability Type: Path traversal through user-controlled file names
Risk Level: MediumVulnerable Code Snippets
From
SKILL.md:markdown 61: - Update the "last updated date" at the top of `domains/{domain name}.md`markdown 68: 1. **Ask for the domain proactively**: Ask the user which domain or topic they want to discuss. 69: 2. **Check the historical archive**: After the user responds, check whether `domains/{domain name}.md` exists:markdown 93: - **If it does not exist**: Create an archive for the domain based on `@reference/domain_template.md`.Supporting file-creation behavior from
domains/README.md:markdown 3: This directory stores domain archive files automatically created and updated by Knowledge Distiller. 5: - Each domain corresponds to a `.md` file, and the file name is the domain name. 9: > This directory is initially empty. A corresponding domain archive is automatically generated after the first conversation.Technical Analysis
The Skill asks the user for a domain name and directly incorporates that value into the path
domains/{domain name}.md. It then instructs the Agent to check, create, read, and update that path. No requirement is provided to sanitize the domain name, reject path separators or traversal components, canonicalize the resulting path, or verify that the resolved path remains inside the intendeddomains/directory.Consequently, an input containing traversal sequences could resolve outside the archive directory. For example, a domain name such as
../../notes/privatewould produce the nominal path:text domains/../../notes/private.mdDepending on the Agent's filesystem permissions and path-handling implementation, this could target a file outside
domains/.Attack Path
- An attacker invokes the Skill and is asked to provide a do ...[truncated 1471 chars]
- Remediation
View remediation
Remediation Suggestions
-
Map display names to safe identifiers
- Preserve the original domain name only as display text.
- Generate a restricted slug for the file name.
- Permit only a conservative character set, such as ASCII letters, digits, hyphens, and underscores.
-
Reject dangerous path syntax
- Reject
..,/,\, null bytes, absolute paths, drive prefixes, URI-like prefixes, and encoded separator variants. - Enforce a reasonable maximum file-name length.
- Reject
-
Canonicalize and enforce containment
- Resolve the candidate path against the canonical
domains/directory. - Verify that the resolved path is a descendant of
domains/before every existence check, read, creation, or update. - Abort the operation if containment validation fails.
- Resolve the candidate path against the canonical
-
Avoid following symbolic links
- Reject archive paths that resolve through symbolic links.
- Use no-follow and exclusive-creation semantics where supported.
-
Prevent accidental overwrites
- Use atomic file creation and updates.
- Do not replace an existing file unless it is a validated archive belonging to the selected domain.
- Apply restrictive file permissions.
-
Document the validation requirement
- Add explicit instructions to
SKILL.mdstating that user-provided domain names must never be used directly as paths. - Update
domains/README.mdto clarify that filenames are sanitized identifiers rather than raw domain names.
- Add explicit instructions to
-
Add negative tests
- Test inputs including
../x,../../x,/tmp/x,C:\x,a/b,a\b, encoded traversal sequences, long names, and names resolving through symbolic links. - Verify that all resulting operations remain confined to the canonical
domains/directory.
- Test inputs including
-