T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:30
- Finding
- Predictable Temporary Script Path Enables Local Code Substitution## Vulnerability Details **File Location**: `SKILL.md:30-33` and `SKILL.md:60-62` **Vulnerability Type**: Unsafe temporary-file handling and execution **Risk Level**: Medium The documented workflow recommends copying the bundled Python script to a predictable path in the shared temporary directory and subsequently executing that copy. ```bash cp <skill_root>/scripts/cornell.py /tmp/cornell.py ``` ```bash python /tmp/cornell.py new "<title>" ``` ### Technical Analysis `/tmp/cornell.py` is a fixed, predictable path in a generally shared and attacker-writable directory. A local attacker or compromised process may attempt to pre-create the destination as a symbolic link, replace the copied file after the copy, or modify it before execution. Because the workflow later passes this path to the Python interpreter, successful substitution results in execution of attacker-controlled Python code. Separating the copy and execution into distinct commands creates a time-of-check/time-of-use opportunity. The risk is unnecessary because the trusted script can be run directly from the Skill directory. ### Attack Path 1. The attacker obtains local access under another account or controls a process capable of writing to the shared temporary directory. 2. The attacker anticipates or observes use of the predictable `/tmp/cornell.py` path. 3. The attacker pre-creates a malicious destination or symbolic link, or replaces/modifies the copied script after the copy operation. 4. The Agent follows the documented workflow and executes: ```bash python /tmp/cornell.py new "<title>" ``` 5. Python executes the substituted content with the privileges and environment of the Agent user. Exploitation depends on local filesystem access and successful timing or destination manipulation. ### Impact Assessment Successful exploitation permits arbitrary code execution with the Agent user's privileges. The attacker could read or modify files available to that user, ...[truncated 257 chars]
- Remediation
- ## Remediation Suggestions Remove all instructions that copy or execute the script through `/tmp/cornell.py`. Execute the trusted bundled script directly: ```bash python <skill_root>/scripts/cornell.py <command> [args] ``` Update the creation workflow similarly: ```bash python <skill_root>/scripts/cornell.py new "<title>" ``` If temporary copying is unavoidable: 1. Create a private temporary directory using a secure random name. 2. Restrict the directory permissions to the current user, such as mode `0700`. 3. Create files atomically and refuse to follow symbolic links. 4. Verify ownership, permissions, and script integrity before execution. 5. Remove the temporary directory immediately after use. 6. Avoid fixed filenames in globally writable directories.