T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:140- Finding
Predictable Shared Temporary Files Permit Local File Clobbering and Data Disclosure
- Content
View full analysis
/tmp/commits.txt # Get detailed commit information grouped by author git log --since="$START_DATE" --until="$END_DATE" --pretty=format:"%ad | %s | %an" --date=short --no-merges > /tmp/commits_detailed.txt # Count commits COMMIT_COUNT=$(git log --since="$START_DATE" --until="$END_DATE" --oneline --no-merges | wc -l) ``` ```bash # Find all TODO comments echo "## TODO注释汇总" > /tmp/todos.txt grep -r -n "TODO\|FIXME\|HACK" . --include="*.js" --include="*.py" --include="*.java" --include="*.ts" --include="*.go" --include="*.cpp" --include="*.rs" 2>/dev/null | head -20 >> /tmp/todos.txt # Find todo files echo -e "\n## Todo文件内容" >> /tmp/todos.txt find . -name "TODO*" -o -name "todo*" -o -name "tasks*" 2>/dev/null | while read file; do echo "### $file" >> /tmp/todos.txt head -20 "$file" >> /tmp/todos.txt 2>/dev/null echo "" >> /tmp/todos.txt done ``` ```bash # Create report file REPORT_FILE="工作报告_$(date +%Y%m%d).md" # Populate report template cat > "$REPORT_FILE" << EOF # 工作报告 - $START_DATE 至 $END_DATE ## 概述 - **报告类型**: 周报 - **时间范围**: $START_DATE 至 $END_DATE - **生成时间**: $(date "+%Y-%m-%d %H:%M:%S") - **代码提交数量**: $COMMIT_COUNT ## 一、已完成的工作 ### 代码提交 $(cat /tmp/commits.txt | sed 's/^/- /') ### 功能完成 [根据提交信息总结完成的功能] ### 问题修复 [根据提交信息总结修复的问题] ## 二、进行中的任务 $(cat /tmp/todos.txt) ``` ### Technical Analysis The documented workflow stores project information in fixed, globally predictable paths: `/tmp/commits.txt`, `/tmp/commits_detailed.txt`, and `/tmp/todos.txt`. It does not securely create these files, verify their ownership or type, reject symbolic links, establish restrictive permissions, or isolate each execution in a private temporary directory. On systems ...[truncated 2514 chars]- Remediation
View remediation
&2 exit 1 } trap 'rm -rf -- "$TMP_DIR"' EXIT HUP INT TERM COMMITS_FILE="$TMP_DIR/commits.txt" COMMITS_DETAILED_FILE="$TMP_DIR/commits_detailed.txt" TODOS_FILE="$TMP_DIR/todos.txt" git log --since="$START_DATE" --until="$END_DATE" \ --oneline --no-merges > "$COMMITS_FILE" git log --since="$START_DATE" --until="$END_DATE" \ --pretty=format:"%ad | %s | %an" --date=short --no-merges \ > "$COMMITS_DETAILED_FILE" echo "## TODO comment summary" > "$TODOS_FILE" ``` Then reference the secured variables rather than fixed paths: ```bash sed 's/^/- /' "$COMMITS_FILE" cat "$TODOS_FILE" ``` Additional hardening measures: 1. Set `umask 077` before creating files so only the executing user can read or modify them. 2. Never reuse constant filenames directly under a shared temporary directory. 3. Use `mktemp` or `mktemp -d`; do not generate temporary names solely from timestamps or process IDs. 4. Register a cleanup trap immediately after creating the temporary directory. 5. Quote every pathname and use `--` where supported to prevent option confusion. 6. Avoid intermediate files entirely when feasible by retaining results in controlled variables or directly streaming data into the report. 7. If fixed files must be supported for compatibility, reject symbolic links, verify ownership and permissions, and open files using platform mechanisms that enforce exclusive creation and no-follow behavior. ]]>