T09 · Insecure Skill Coding Practices
Error
- Location
scripts/materialize_team.mjs:8- Finding
Root-Level Path Traversal Enables Arbitrary File Creation and Overwrite
- Content
View full analysis
s.trim()).filter(Boolean); const leaderId = args['leader-id'] || `${team}-team-leader`; const roleIdMap = new Map(roles.map(r => [r, (r==='team-leader' ? leaderId : r)])); ``` ```js const teamRoot = `/root/.openclaw/workspace-${team}`; fs.mkdirSync(teamRoot,{recursive:true}); for (const d of ['requirements','architecture','design','implementation','qa']) fs.mkdirSync(path.join(teamRoot,'shared',d),{recursive:true}); const resolvedRoleIds = roles.map(r => roleIdMap.get(r)); cfg.agents.list = cfg.agents.list.filter(a => !resolvedRoleIds.includes(a?.id)); ``` ```js for (const rid0 of roles){ const rid = roleIdMap.get(rid0); const p = PRESET[rid0] || {zh:rid0, emoji:'🤖'}; const displayBase = locale.startsWith('zh') ? p.zh : rid0; const display = rid0==='team-leader' ? `${displayBase}（${team}）` : displayBase; const agent = { id: rid, workspace: `${teamRoot}/${rid}`, model: {primary:model, fallbacks:FALLBACKS}, identity: {name: display, emoji: p.emoji}, tools: {profile:'full'}, subagents: {allowAgents: rid0==='team-leader' ? roles.filter(x=>x!=='team-leader').map(x=>roleIdMap.get(x)) : [leaderId]} }; cfg.agents.list.push(agent); fs.mkdirSync(agent.workspace,{recursive:true}); let soul; let agents; if (rid0 === 'team-leader') { const soulTpl = fs.readFileSync(path.join(__dirname, '..', 'references', 'team-leader-template.md'), 'utf8'); const agentsTpl = fs.readFileSync(path.join(__dirname, '..', 'references', 'team-leader-agents-template.md'), 'utf8'); soul = soulTpl .replaceAll('{{LEADER_ID}}', rid) .replaceAll('{{TEAM_DISPLAY}}', locale.startsWith('zh') ? `${team}团队` : team) .replace ...[truncated 2958 chars]- Remediation
View remediation