T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/utils/validator.js:12
- Finding
- Arbitrary Local Files Can Be Uploaded to an External Service<![CDATA[ ## Vulnerability Details **File Location**: `scripts/utils/validator.js:12-19`; upload flow in `scripts/video2text/index.js:128-149` **Vulnerability Type**: Unrestricted local file selection and external upload **Risk Level**: High ### Code Snippet ```js function isFilePath(path) { try { const stats = fs.statSync(path); return stats.isFile(); } catch (_) { return false; } } ``` The accepted file is subsequently sent to a remotely supplied upload destination: ```js } else if (!validator.isFilePath(file)) { utils.printError("无效的文件路径或URL"); process.exit(1); } if (!fs.existsSync(file)) { utils.printError("文件不存在: " + file); process.exit(1); } try { const presignedUrl = await video.getPresignedUrl(tokenValue, file); if (!presignedUrl || !presignedUrl?.url || presignedUrl.url === "") { throw new Error("获取预签名URL失败，请反馈给开发者"); } utils.printInfo("上传文件到安全空间..."); await upload.uploadFileToOSS(file, presignedUrl.url, presignedUrl.headers); ``` ### Technical Analysis The local path validator only verifies that the supplied path resolves to a regular file. It does not verify that the file is a video or audio asset, restrict access to user-approved directories, inspect the file signature, reject symbolic links, or impose a maximum file size. Because the Skill is intended to be invoked by an AI agent based on natural-language input, an attacker may attempt to persuade the agent to treat a sensitive local file as a video input. Any file readable by the Node.js process could pass this validation and be uploaded. The upload operation opens the accepted path with `fs.createReadStream()` and transmits its full contents to an external destination. The same validation therefore permits uploading configuration files, source code, SSH keys, cloud credentials, API configuration, or other sensitive data. ### Attack Path 1. An attacker supplies a local path through `--file`, either directly or through instructions interpreted b ...[truncated 1101 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Resolve the canonical path with `fs.realpath()` and reject symbolic links using `fs.lstat()`. 2. Restrict local uploads to explicitly approved directories or require interactive confirmation displaying the canonical path. 3. Enforce an allowlist of expected media extensions, while treating extensions only as an initial filter. 4. Verify file signatures or use a trusted media parser to confirm that the file is an actual supported audio or video format. 5. Reject known sensitive locations such as home credential directories, SSH directories, cloud configuration directories, and system configuration paths. 6. Apply a strict maximum file size before opening the upload stream. 7. Use least-privilege runtime isolation so the Skill cannot read files outside a dedicated media workspace. 8. Avoid accepting local paths inferred solely from untrusted natural-language content. ]]>