T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/clawpay-cli.js:378
- Finding
- User-Controlled Skill ID Enables Archive Path Traversal<![CDATA[ ## Vulnerability Details **File Location**: `scripts/clawpay-cli.js:378-380` **Vulnerability Type**: Path traversal leading to arbitrary file overwrite and deletion **Risk Level**: High ### Vulnerable Code ```javascript const zipName = `${skillId}.zip`; const zipPath = path.join(process.cwd(), zipName); fs.writeFileSync(zipPath, res.body); ``` ### Technical Analysis The `skillId` value originates from the `--skill-id` command-line argument and is used directly when constructing the downloaded archive path. No allowlist validation or basename normalization is applied before passing the resulting path to `fs.writeFileSync`. Because `path.join()` normalizes traversal components, a value such as `../../target` produces a path outside the current working directory. The `.zip` suffix limits the final filename, but it does not prevent directory traversal. The same path is later passed to `fs.unlinkSync`, so successful exploitation can both overwrite and subsequently delete the selected file. ### Attack Path 1. An attacker persuades the user or agent to invoke `downloadSkill` with a crafted Skill ID containing traversal components, such as `../../some/path/target`. 2. The client includes this value in the server request. 3. If the server returns a binary response, the response body is written to the path derived from the malicious Skill ID. 4. The resolved path escapes the intended working directory. 5. The file is overwritten with the downloaded response body. 6. During cleanup, the same path may be deleted with `fs.unlinkSync`. Exploitation requires the remote service to return a binary download response for the supplied identifier, or an attacker to control or compromise that service response. ### Impact Assessment The process can overwrite or delete files accessible to the current user, provided the targeted filename can end in `.zip`. This can corrupt user data, interfere with other applications, or modify application artifacts. The vulnerabi ...[truncated 80 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Validate `skillId` with a strict allowlist before using it in any filesystem operation, for example: ```javascript if (!/^[A-Za-z0-9_-]+$/.test(skillId)) { throw new Error('Invalid Skill ID'); } ``` - Create a private temporary directory with `fs.mkdtempSync()` and use a fixed archive filename rather than deriving the filename from user input. - Resolve the final path and verify that it remains beneath the intended download directory. - Open newly created files with restrictive permissions and exclusive creation flags. - Perform cleanup in a `finally` block using only paths generated internally by the application. ]]>