T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_audio.py:50- Finding
Predictable Shared Temporary Files Allow Local File Overwrite and Cross-Run Interference
- Content
View full analysis
/dev/null 2>&1") == 0 if has_ffmpeg and len(tmps) > 1: lst = "/tmp/pod_list.txt" with open(lst, "w") as f: for t in tmps: f.write(f"file '{t}'\n") ``` ### Technical Analysis The audio generation process creates temporary media files using predictable names such as `/tmp/pod_000.mp3` and writes the FFmpeg input list to the fixed path `/tmp/pod_list.txt`. The system temporary directory is commonly writable by all local users. The code does not: - Create a private, randomly named temporary directory. - Use exclusive file creation. - Reject symbolic links. - Verify file ownership or type before writing. - Isolate files belonging to concurrent executions. The call to `open("/tmp/pod_list.txt", "w")` follows symbolic links and truncates the resolved target. A local attacker who can write to `/tmp` can pre-create that path as a symbolic link to another file writable by the victim. Predictable media names also allow concurrent or malicious executions to overwrite, replace, or mix audio segments. The temporary list file is not included in the cleanup routine, leaving stale state in the shared temporary directory. ### Attack Path 1. A local attacker identifies that the ...[truncated 1546 chars]- Remediation
View remediation