T09 · Insecure Skill Coding Practices
Warning
- Location
` ``` ```text Write the paperwork facts into the shared `~/Clawic/data/pets/<name>.md` ``` ```text Anything durable this table does not name | `~/Clawic/data/travel/<plural-noun>.md`, or `artifacts/<kebab-name>.md` ``` ### Technical Analysis The Skill constructs or follows filesystem paths derived from configuration entries, persistent `## Boxes` records, pet names, place names, provider names, and other user-controlled labels. It does not require canonicalization, path-separator filtering, traversal re ...[truncated 2022 chars]:38- Finding
Unvalidated Dynamic Paths Can Escape Declared Data Directories
- Content
View full analysis
` ``` ```text Write the paperwork facts into the shared `~/Clawic/data/pets/.md` ``` ```text Anything durable this table does not name | `~/Clawic/data/travel/.md`, or `artifacts/.md` ``` ### Technical Analysis The Skill constructs or follows filesystem paths derived from configuration entries, persistent `## Boxes` records, pet names, place names, provider names, and other user-controlled labels. It does not require canonicalization, path-separator filtering, traversal rejection, or verification that the resolved path remains within the directories declared in `configPaths`. This conflicts with the Skill's claim that all reads and writes remain within its declared data directories. Values such as `../../Documents/private.md`, absolute paths, or symlinks that resolve outside an allowed directory could redirect an agent to unrelated local files. Persisted `## Boxes` entries are particularly sensitive because the Skill directs the agent to treat that index as authoritative and open referenced files when their conditions apply. A malicious or compromised entry could therefore trigger unintended file access in later sessions. ### Attack Path 1. An attacker influences a configuration value, filename-producing label, or persisted `## Boxes` entry. 2. The attacker supplies a path containing traversal components, an absolute path, or a path through a symlink. 3. A later request activates the relevant travel workflow. 4. The agent follows the Skill's instruction to read or write the derived path. 5. Because no co ...[truncated 856 chars]- Remediation
View remediation