T09 · Insecure Skill Coding Practices
- Location
SKILL.md:81- Finding
Predictable Shared Temporary File Enables Symlink and Race Attacks
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 81–92
Vulnerability Type: Unsafe temporary-file handling
Risk Level: MediumThe documented audio-processing workflow uses the fixed, globally predictable path
/tmp/audio.mp3, forcibly overwrites it, and later reads it for upload to an external transcription service.bash # 1. Convert the format ffmpeg -i /path/to/audio.ogg -ar 16000 -ac 1 /tmp/audio.mp3 -y # 2. Call the SiliconFlow API python3 -c " import requests import os api_key = os.environ.get('SILICONFLOW_API_KEY') if not api_key: raise ValueError('Please set the SILICONFLOW_API_KEY environment variable') with open('/tmp/audio.mp3', 'rb') as f: audio_data = f.read()Technical Analysis
/tmpis commonly writable by all local users. Although operating systems generally apply the sticky bit to this directory, that protection does not make predictable filenames safe. An attacker who can create/tmp/audio.mp3before the workflow runs may use a symbolic link or another filesystem object to influence the operation. The-yoption instructs FFmpeg to overwrite an existing destination without confirmation.There is also a time-of-check/time-of-use window between FFmpeg writing the output and Python reopening the same pathname. A local attacker may attempt to replace or redirect the pathname during that interval. The Python code does not verify that the opened object is a regular file, that it is owned by the expected account, or that it is the file produced by the current invocation.
Concurrent invocations also share the same path. One request may overwrite or upload another request's audio, causing cross-request data exposure and incorrect transcription. No cleanup is shown, so sensitive audio can remain in
/tmpafter processing.Attack Path
- A local attacker predicts that the skill will use
/tmp/audio.mp3. - The attacker pre-creates that path as a sym ...[truncated 1652 chars]
- A local attacker predicts that the skill will use
- Remediation
View remediation
Remediation Suggestions
- Create a private temporary directory with an unpredictable name using Python's
tempfile.TemporaryDirectory, or create the output withtempfile.mkstemp. - Restrict temporary-file permissions to the executing user, preferably mode
0600, and ensure the parent directory is mode0700. - Generate a unique path for every invocation so concurrent requests cannot collide.
- Do not use a constant pathname in a shared temporary directory.
- Where supported, open files with protections equivalent to
O_CREAT | O_EXCL | O_NOFOLLOWand verify withfstatthat the object is a regular file owned by the expected user. - Keep the validated file descriptor open where possible instead of closing and reopening a pathname that can be replaced.
- Pass subprocess arguments as an argument array rather than interpolating shell commands when implementing the documented workflow.
- Delete temporary audio in a
finallyblock or rely on automatic cleanup fromTemporaryDirectory. - Obtain explicit user authorization before uploading audio and clearly disclose the external recipient, particularly when recordings may contain personal or confidential information.
- Create a private temporary directory with an unpredictable name using Python's