T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup-worktree.sh:45- Finding
Existing Worktree Resources Are Recursively Deleted Before Symlink Creation
- Content
View full analysis
$target" else echo " link $rel -> $target" fi mkdir -p "$(dirname "$dest")" ln -s "$target" "$dest" ``` ### Technical Analysis The `link_resource` helper deletes an existing destination recursively before replacing it with a symlink. This behavior is unsafe because: 1. Existing untracked files or directories are removed without backup or confirmation. 2. The `rel` argument is not validated against absolute paths or `..` path traversal. 3. The computed destination is not canonicalized and verified to remain inside `CURRENT_DIR`. 4. The script is intended to run automatically through session or worktree hooks, so deletion may occur without an immediately preceding user action. Shell quoting prevents ordinary argument splitting, but it does not provide path containment. A mistakenly or maliciously generated resource declaration could therefore make `dest` refer outside the intended worktree. The packaged declarations are static and benign, so exploitation depends on an unsafe declaration being generated or added when this template is customized. Nevertheless, the helper exposes a dangerous primitive to the agent-driven generation workflow. ### Attack Path 1. A repository contains misleading setup documentation, filenames, or other attacker-controlled content that influences the Skill's repository audit. 2. The agent classifies an attacker-selected path as a shared resource and passes it to `link_resource`. 3. The generated script is installed behind a `SessionStart` or worktree hook. 4. On invocation, `dest` resolves to an existing path, potentially outside the worktree if traversal was accepted. 5. `rm -rf "$dest"` recursively deletes that path. 6. The delet ...[truncated 467 chars]- Remediation
View remediation