T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
skill_evolver/analyzer.py:58- Finding
Unrestricted Skill Path Allows Analysis Outside the Configured Skill Directory
- Content
View full analysis
SkillAnalysisResult: """ 分析单个技能 """ skill_path = self.skills_dir / skill_name result = SkillAnalysisResult( skill_name=skill_name, skill_path=str(skill_path) ) ``` The resulting path is subsequently used for recursive file discovery: ```python def _analyze_python_code(self, result: SkillAnalysisResult, skill_path: Path): """分析 Python 代码文件""" python_files = list(skill_path.rglob("*.py")) ``` ### Technical Analysis The analyzer constructs the target path by directly joining the configured Skill directory with the caller-controlled `skill_name`. It does not reject: - Parent-directory components such as `..` - Absolute paths - Symbolic links that resolve outside the Skill root - Alternate paths that normalize outside the intended directory With `pathlib`, joining a base path with an absolute path discards the base path. Relative traversal components can similarly escape the configured directory after filesystem resolution. The escaped path is used to read `SKILL.md`, parse `package.json`, and recursively discover and parse every Python file beneath the target. Although the implementation does not print complete source contents, it can disclose directory existence, resolved paths, filenames, syntax errors, line numbers, and code-quality information about files outside the authorized Skill repository. Recursive traversal can also impose substantial CPU and memory costs when pointed at a large directory. ### Atta ...[truncated 1324 chars]- Remediation
View remediation