T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/save-to-obsidian.sh:8- Finding
Unrestricted Local File Transfer and Unvalidated SCP Destination
- Content
View full analysis
[ssh_host] [filename_override]}" VAULT_DIR="${2:?Usage: $0 [ssh_host] [filename_override]}" SSH_HOST="${3:-${OBSIDIAN_HOST:-}}" FILENAME="${4:-$(basename "$SOURCE")}" if [[ -z "$SSH_HOST" ]]; then echo "Error: SSH host required (arg 3 or OBSIDIAN_HOST env var)" exit 1 fi # Sanitize filename (no spaces, safe for iCloud) SAFE_FILENAME=$(echo "$FILENAME" | tr ' ' '-' | tr -cd '[:alnum:]._-') if [[ -z "$SAFE_FILENAME" ]]; then SAFE_FILENAME="obsidian-note-$(date +%Y%m%d-%H%M%S).md" fi DEST_PATH="${VAULT_DIR}/${SAFE_FILENAME}" echo "Saving to Obsidian..." echo " Source: $SOURCE" echo " Dest: ${SSH_HOST}:${DEST_PATH}" if scp "$SOURCE" "${SSH_HOST}:${DEST_PATH}"; then ``` ### Technical Analysis The script accepts the source path, remote vault path, and SSH destination through unrestricted command-line arguments or an environment variable. It does not verify that the source is: - A regular file. - A Markdown file. - Located in a dedicated temporary directory. - Not a symbolic link to a sensitive file. Although shell quoting prevents ordinary word splitting and shell metacharacter expansion, it does not establish that the supplied values are safe operands for `scp`. Values beginning with option-like syntax or containing unsafe remote-path syntax may be interpreted by `scp`, SSH, or the remote shell, depending on the installed OpenSSH version and transfer mode. The Skill only needs to transfer generated Markdown content to one preconfigured Obsidian vault. Permitting arbitrary source files and runtime-controlled destinations exceeds that minimum capability. The reference to `~/.ssh/id_rsa` in `SKILL.md:101` is documentation only. The reviewed proj ...[truncated 1512 chars]- Remediation
View remediation