T09 · Insecure Skill Coding Practices
Error
- Location
scripts/helpers.sh:5- Finding
Predictable shared temporary files permit symlink attacks and cache poisoning
- Content
View full analysis
/dev/null || stat -f %m "$file" 2>/dev/null) )) if (( age < ttl )); then cat "$file" return 0 fi fi return 1 } cache_set() { local name="$1" local file="$CACHE_DIR/${name}.json" mkdir -p "$CACHE_DIR" cat > "$file" } ``` ```bash # scripts/cricket-alert.sh STATE_FILE="/tmp/cricket-alert-state.json" if [[ ! -f "$STATE_FILE" ]]; then echo '{"last_check":"","matches":{}}' > "$STATE_FILE" fi prev_state=$(cat "$STATE_FILE") # ... echo '{"last_check":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","matches":{}}' > "$STATE_FILE" # ... echo "$prev_state" | jq --arg id "$id" --argjson w "$total_wickets" --argjson r "$total_runs" --arg s "$status" \ '.matches[$id] = {"wickets": $w, "runs": $r, "status": $s}' > "$STATE_FILE.tmp" 2>/dev/null if [[ -f "$STATE_FILE.tmp" ]]; then mv "$STATE_FILE.tmp" "$STATE_FILE" prev_state=$(cat "$STATE_FILE") fi ``` ### Technical Analysis The Skill stores cache and alert state in fixed, predictable paths under the globally shared `/tmp` directory. It creates these paths without: - Ensuring that the directory and files are owned by the current user. - Applying restrictive permissions such as `0700` and `0600`. - Rejecting symbolic links. - Securely creating temporary files. - Atomically publishing cache updates. Shell redirection follows symbolic links. Consequently, an attacker with access to the same host can pre-create `/tmp/cricket-alert-state.json`, `/tmp/c ...[truncated 1621 chars]- Remediation
View remediation