T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:462- Finding
Unvalidated Content Paths Permit Arbitrary File Overwrite
- Content
View full analysis
"$BLOG_ROOT/src/content/$CATEGORY/$FILENAME" <<'EOF' --- title: "Judul Artikel Baru" slug: judul-artikel-baru summary: "Ringkasan singkat tentang artikel ini yang menarik perhatian pembaca." type: note category: Tech tags: [react, typescript, tutorial] date: "2026-02-12T15:00:00" readingTime: 5 --- Content here... EOF ``` The same unsafe path construction is repeated in the documented writing, article, and read-item workflows: ```bash cat > "$BLOG_ROOT/src/content/$CATEGORY/$FILENAME" <<'EOF' ``` ### Technical Analysis The workflow treats `CATEGORY` and `FILENAME` as path components but does not validate, normalize, or constrain either value before using them in a shell redirection target. Shell quoting prevents word splitting and wildcard expansion, but it does not prevent traversal sequences such as `../`. The operating system resolves these components before opening the destination. Moreover, the `>` operator opens the resolved file with truncation, destroying existing content before writing the generated MDX data. For example, with a legitimate category and a malicious filename: ```bash CATEGORY="writing" FILENAME="../../../package.json" ``` the resulting path is: ```text /home/hades/BangunAI-Blog/src/content/writing/../../../package.json ``` which resolves to: ```text /home/hades/BangunAI-Blog/package.json ``` Additional traversal components could target any file writable by the account running the Agent. A malicious `CATEGORY` can similarly escape `src/content`. ### Attack Path 1. A user requests content creati ...[truncated 1321 chars]- Remediation
View remediation
&2 exit 1 ;; esac ``` 2. **Restrict filenames to safe MDX names** ```bash if [[ ! "$FILENAME" =~ ^[a-z0-9][a-z0-9-]*\.mdx$ ]]; then echo "Invalid filename" >&2 exit 1 fi ``` This rejects directory separators, traversal components, whitespace, shell metacharacters, and unexpected extensions. 3. **Verify the canonical destination** ```bash BASE="$BLOG_ROOT/src/content/$CATEGORY" DEST=$(realpath -m -- "$BASE/$FILENAME") BASE_REAL=$(realpath -- "$BASE") case "$DEST" in "$BASE_REAL"/*) ;; *) echo "Destination escapes the content directory" >&2 exit 1 ;; esac ``` 4. **Prevent unintended replacement** Refuse to overwrite an existing destination unless the user explicitly authorizes it: ```bash if [ -e "$DEST" ]; then echo "Destination already exists; explicit overwrite approval required" >&2 exit 1 fi ``` For new files, use noclobber mode or an atomic exclusive-creation mechanism where practical. 5. **Apply the validation consistently** Use one shared validated writer implementation for every copy of the workflow in `SKILL.md`, `README.md`, and `EXAMPLES.md` so that users do not copy an unsafe variant. 6. **Consider symbolic-link defenses** Ensure the destination directory and target are not attacker-controlled symbolic links. For stronger guarantees, create files through a trusted directory descriptor using exclusive and no-follow semantics. ]]>