T09 · Insecure Skill Coding Practices
- Location
agent_bridge.py:24- Finding
Path Traversal Enables Arbitrary Directory Creation and JSON File Placement
- Content
View full analysis
Vulnerability Details
File Location:
agent_bridge.py, lines 24-49
Vulnerability Type: Unsanitized path construction and path traversal
Risk Level: HighVulnerable Code
python class AgentBridge: def __init__(self, agent_name: str): self.agent_name = agent_name self.inbox_dir = INBOX_DIR / agent_name.lower() self.outbox_dir = OUTBOX_DIR / agent_name.lower() self.inbox_dir.mkdir(parents=True, exist_ok=True) self.outbox_dir.mkdir(parents=True, exist_ok=True) def send_message(self, to: str, subject: str, content: str, priority: str = "normal"): timestamp = datetime.utcnow().strftime('%Y%m%d_%H%M%S_%f') msg_id = f"msg_{timestamp}" message = { "id": msg_id, "from": self.agent_name, "to": to, "timestamp": datetime.utcnow().isoformat() + 'Z', "priority": priority, "subject": subject, "content": content, "read": False } # Directly send to the recipient inbox outfile = INBOX_DIR / to.lower() / f"{msg_id}.json" outfile.parent.mkdir(parents=True, exist_ok=True) with open(outfile, 'w', encoding='utf-8') as f: json.dump(message, f, indent=2, ensure_ascii=False)Technical Analysis
The attacker-controlled
agent_nameandtovalues are used directly as filesystem path components. The implementation neither validates their format nor resolves and verifies that the resulting paths remain below the intended bridge directory.A value containing
..components can traverse outsideINBOX_DIRorOUTBOX_DIR. Withpathlib, an absolute value can also cause the intended base path to be discarded. The call tomkdir(parents=True, exist_ok=True)creates attacker-selected directories, after whichsend_message()places a JS ...[truncated 1553 chars]- Remediation
View remediation
Remediation Suggestions
-
Restrict agent identifiers to a conservative allowlist, such as
^[A-Za-z0-9_-]{1,64}$. -
Reject empty identifiers, absolute paths, path separators, drive designators, null bytes, and
.or..components. -
Resolve the intended destination before creating directories or files, then verify containment:
python SAFE_NAME = re.compile(r"^[A-Za-z0-9_-]{1,64}$") def safe_agent_directory(base: Path, name: str) -> Path: if not SAFE_NAME.fullmatch(name): raise ValueError("Invalid agent identifier") base = base.resolve() destination = (base / name.lower()).resolve() if destination.parent != base: raise ValueError("Agent directory escapes storage root") return destination -
Use the validated helper consistently for constructor paths and recipient paths.
-
Create bridge directories with restrictive permissions and run the process under a dedicated, least-privileged account.
-
Add tests covering traversal strings, absolute paths, separators, Unicode edge cases, and excessively long identifiers.
-