T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:69- Finding
Path Traversal Through Unsanitized LLM-Generated Filename
- Content
View full analysis
"$outputPath" ``` ### Technical Analysis The `titleSlug` value is produced by the LLM after processing attacker-controllable draft content. It is then concatenated directly into `outputPath` without validation, sanitization, or canonical-path containment checks. Shell quoting prevents shell metacharacters from producing direct command injection, but it does not prevent filesystem path traversal. A generated slug containing path separators and traversal components, such as `../../../target`, can cause the resulting path to resolve outside the intended `outputDir`. The subsequent `mkdir -p` and output redirection operate on that untrusted path. Consequently, the workflow can create directories and overwrite a Markdown file outside the documented output directory. ### Attack Path 1. An attacker supplies or modifies the Markdown draft processed by the skill. 2. The draft includes content or prompt-injection text intended to influence the LLM-generated `titleSlug`. 3. The LLM returns a slug containing traversal components, such as `../../../attacker-target`. 4. The `prepare_output` step concatenates that value into `${outputDir}/${ts}_${titleSlug}.md` ...[truncated 946 chars]- Remediation
View remediation
&2 exit 1 ;; esac ``` The containment check should be retained even when an allowlist is used, providing defense in depth. ]]>