T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:82
- Finding
- Predictable Shared Temporary Files May Expose Private Brokerage Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 82; repeated at lines 587–592 and 623 **Vulnerability Type**: Predictable temporary-file creation and plaintext storage of sensitive data **Risk Level**: Medium ### Vulnerable Code Snippets At line 82, the Skill establishes this as a general rule: ```markdown - When piping JSON into Python, **save to a temp file first** (`longbridge … --format json > /tmp/x.json`, then `python3 -c "import json; d=json.load(open('/tmp/x.json'))"`). The CLI sometimes appends version-notification lines to stdout that break direct pipes. ``` The unsafe pattern is repeated at lines 587–592: ```markdown **CLI + Python pattern**: prefer reading from a file over piping into `python3 -c`. Multi-line JSON with embedded quotes can hit shell-quoting edge cases (especially under zsh's `-c` argument handling): ```bash longbridge institution-rating 700.HK --format json > /tmp/rating.json python3 -c "import json; d = json.load(open('/tmp/rating.json')); print(d)" ``` ``` It is mandated again at line 623: ```markdown **JSON output handling**: always save to a temp file first (`longbridge <cmd> --format json > /tmp/data.json`), then read the file. Do not pipe directly — the CLI may append version notification lines that break JSON parsing. ``` ### Technical Analysis The Skill instructs the Agent to redirect Longbridge CLI output into fixed, predictable paths in the shared `/tmp` directory, including `/tmp/x.json`, `/tmp/rating.json`, and `/tmp/data.json`. Shell redirection to a predictable path does not provide exclusive file creation, does not reject symbolic links, and relies on the process umask for file permissions. On systems with a permissive umask, newly created JSON files may be readable by other local users. An attacker may also pre-create the expected path as a symbolic link, causing shell redirection to follow the link and truncate or overwrite another file writable by the Agent process. The instruction ...[truncated 2695 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Avoid disk storage for sensitive responses where possible.** Capture subprocess output directly through an execution API that keeps stdout in memory and separates version notices from structured JSON. 2. **Use a private randomized directory when a file is unavoidable:** ```bash umask 077 tmpdir="$(mktemp -d)" trap 'rm -rf -- "$tmpdir"' EXIT longbridge portfolio --format json > "$tmpdir/result.json" python3 -c 'import json, sys; print(json.load(open(sys.argv[1])))' \ "$tmpdir/result.json" ``` 3. **Set restrictive permissions before creating any temporary artifact.** Use `umask 077` so files are accessible only to the current user. 4. **Create files atomically and exclusively.** Prefer language-level temporary-file APIs such as Python's `tempfile.TemporaryDirectory` or `NamedTemporaryFile`, which generate unpredictable names and can prevent accidental reuse. 5. **Defend against symbolic links.** Use creation methods supporting exclusive creation and no-follow semantics rather than ordinary shell redirection into a known path. 6. **Guarantee cleanup.** Install a cleanup trap immediately after creating the private directory and remove all temporary files on success, failure, or interruption. 7. **Separate public and private workflows.** Explicitly prohibit writing authenticated account responses to shared temporary locations. Statement exports should only be written to a filesystem location confirmed by the user. 8. **Replace every fixed `/tmp` example.** Update the instructions at lines 82, 587–592, and 623 so Agents do not reproduce the unsafe pattern in any workflow. ]]>