T09 · Insecure Skill Coding Practices
- Location
SKILL.md:52- Finding
Unrestricted User-Controlled Output Path May Allow Arbitrary File Writes
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 52-67
Vulnerability Type: Unvalidated file path construction and arbitrary file write
Risk Level: MediumVulnerable Code Snippet
markdown ### 4. 创建本地文件 在用户指定目录下创建文件夹并写入文件。 **文件夹命名**：使用题目序号+名称（如 `42.接雨水`） **文件结构**：{目录}/{序号}.{名称}/ ├── 题目内容.md ├── 解题思路.md └── {序号}.{ext}
text Technical Analysis
The skill instructs the agent to create directories and write three files using a user-provided base directory and a folder name derived from user-provided problem identifiers. It does not require path canonicalization, traversal-component rejection, an approved output root, symbolic-link checks, or overwrite protection.
If these values are passed directly to filesystem tools, an attacker could supply an absolute output directory or path components such as
../to direct writes outside the intended workspace. A pre-existing symbolic link could similarly redirect output to another location. Because the generated filenames are predictable, existing files at the selected destination may also be overwritten if the underlying write operation permits it.This is an insecure coding and configuration practice rather than evidence of intentional malicious behavior. Exploitability depends on how the agent's filesystem tools enforce permissions and whether they independently restrict output paths.
Attack Path
- An attacker invokes the skill and supplies a crafted local directory or problem name containing absolute or traversal-based path components.
- The skill combines the supplied values into
{directory}/{number}.{name}without requiring validation or canonicalization. - The agent creates the resulting directory and writes the problem statement, solution explanation, and source-code file.
- If the resolved path escapes the intended workspace—or passes through an attacker-prepared symbolic link—the files are written to an unint ...[truncated 816 chars]
- Remediation
View remediation
Remediation Suggestions
- Restrict all generated output to an explicitly approved workspace root.
- Resolve the workspace root and proposed destination to canonical absolute paths, then verify that the destination remains beneath the approved root.
- Treat the problem number and title as filename components rather than paths. Reject
/,\,.., null bytes, drive prefixes, and other platform-specific path metacharacters. - Prefer constructing folder names from a strict allowlist, such as letters, digits, spaces, hyphens, underscores, and a limited set of safe Unicode characters.
- Detect symbolic links in every existing destination component and refuse writes where a link could redirect output outside the approved root.
- Use exclusive file creation or require explicit user confirmation before overwriting existing files.
- Display the fully resolved destination paths before writing and request confirmation when the destination was supplied by the user.
- Apply least-privilege filesystem permissions so the agent cannot write to system directories or unrelated user data.