T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:255
- Finding
- Unvalidated Feature Slug Permits Filesystem Path Traversal<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 255-294 **Vulnerability Type**: Unvalidated input in filesystem paths **Risk Level**: Medium ### Vulnerable Code ```bash FEATURE=$1 # Create feature definition mkdir -p docs/define/features/$FEATURE cat > docs/define/features/$FEATURE/feature.md << EOF # Feature: $(echo $FEATURE | tr '-' ' ' | sed 's/\b\(.\)/\u\1/g') ## Summary TODO: Add summary ## User Stories As a user, I want to TODO, so that TODO. EOF # Create initial tasks for task in "design" "implement" "test" "document"; do mkdir -p docs/todo/pending/${FEATURE}-${task} cat > docs/todo/pending/${FEATURE}-${task}/task.md << EOF # Task: $(echo $FEATURE | tr '-' ' ' | sed 's/\b\(.\)/\u\1/g') - $(echo $task | sed 's/\b\(.\)/\u\1/g') ## Summary ${task^} the $FEATURE feature. ## Objectives - TODO ## Acceptance Criteria - [ ] TODO EOF echo "medium" > docs/todo/pending/${FEATURE}-${task}/.priority done echo "Created feature: $FEATURE" echo "Created tasks: ${FEATURE}-design, ${FEATURE}-implement, ${FEATURE}-test, ${FEATURE}-document" ``` ### Technical Analysis The batch-creation script assigns its first positional argument directly to `FEATURE` and subsequently incorporates that value into directory and output-file paths. Although the surrounding documentation requires feature names to follow a lowercase slug format, the script does not enforce that policy. A value containing path traversal components such as `../` can cause the normalized destination to escape `docs/define/features/`. For example, the feature-definition operations effectively resolve paths of the following form: ```text docs/define/features/<attacker-controlled-value>/feature.md ``` The expansions are also unquoted. Consequently, shell word splitting and pathname expansion can alter arguments supplied to commands such as `mkdir`, producing unexpected directories or failed and ambiguous redirections. This issue does not permit shell metacharacters ...[truncated 1777 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require an argument and validate it against the documented slug format before performing any filesystem operation: ```bash set -euo pipefail FEATURE=${1:?Usage: $0 <feature-slug>} if [[ ! $FEATURE =~ ^[a-z0-9]+(-[a-z0-9]+)*$ ]]; then echo "Invalid feature slug: use lowercase letters, digits, and single hyphens." >&2 exit 1 fi if ((${#FEATURE} > 30)); then echo "Invalid feature slug: maximum length is 30 characters." >&2 exit 1 fi ``` 2. Quote every variable expansion used as a command argument or redirection path: ```bash feature_dir="docs/define/features/$FEATURE" mkdir -p -- "$feature_dir" cat > "$feature_dir/feature.md" <<EOF # Feature: $FEATURE EOF for task in design implement test document; do task_dir="docs/todo/pending/${FEATURE}-${task}" mkdir -p -- "$task_dir" cat > "$task_dir/task.md" <<EOF # Task: $FEATURE - $task EOF printf '%s\n' medium > "$task_dir/.priority" done ``` 3. Resolve and verify destination paths before writing when stronger containment is required. Confirm that each normalized destination remains beneath the intended project directory. 4. Refuse to overwrite existing files unless replacement is explicitly requested. For example, check for an existing `feature.md` and exit safely. 5. Add automated negative tests covering traversal strings, absolute paths, whitespace, wildcard characters, empty arguments, excessive length, and malformed hyphen placement. ]]>