T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:41
- Finding
- Confidential Legal Data Written to Predictable Files## Vulnerability Details **File Location**: `SKILL.md`, lines 41–42 **Vulnerability Type**: Unsafe temporary-file handling and plaintext sensitive-data storage **Risk Level**: Medium **Complete source excerpt, translated into English:** ```text 1. Always write the request body to `body.json` to avoid escaping failures for long Chinese text on the command line. 2. Save the request result as `response.json` and record `HTTP_STATUS` at the same time. ``` ### Technical Analysis The skill requires every API request and response to be written to fixed, relative filenames: `body.json` and `response.json`. Legal documents may contain confidential personal, commercial, litigation, or privileged information. The instructions do not require restrictive permissions, a private directory, randomized filenames, exclusive file creation, symbolic-link protection, or deletion after processing. Predictable relative paths also create race and collision risks when multiple skill instances run in the same working directory. One invocation may overwrite or consume data belonging to another invocation. On systems where an attacker can modify the working directory, a pre-created symbolic link may cause the agent to write data to an unintended file accessible with the agent process's existing permissions. ### Attack Path 1. An attacker obtains local access to, or write access within, the directory used for skill execution. 2. The attacker monitors the predictable `body.json` and `response.json` paths or creates one of those paths as a symbolic link. 3. A user invokes the skill with confidential legal text. 4. The agent writes the request and response to the predictable paths. 5. The attacker reads the retained information, causes cross-run data exposure, or redirects a write to another location writable by the agent. This path requires local filesystem access or another process operating under a context that can access the working directory. ...[truncated 569 chars]
- Remediation
- ## Remediation Suggestions - Avoid writing request and response bodies to disk when the HTTP client can stream them directly from and into memory. - If files are necessary, create a private temporary directory with permissions restricted to the current user. - Generate cryptographically random filenames rather than using fixed relative paths. - Create files atomically and exclusively, reject symbolic links, and set file permissions to `0600`. - Keep request and response files separate for every invocation to prevent concurrent-run collisions. - Delete temporary files in a guaranteed cleanup block, including after network failures and malformed responses. - Redact unnecessary personal or confidential information before transmission and local storage. - Obtain user consent before uploading confidential documents to the external service and document the service's retention and privacy implications.