T09 · Insecure Skill Coding Practices
- Location
scripts/vision_executor.py:69- Finding
Predictable Output Filename Allows Silent File Overwrite
- Content
View full analysis
Vulnerability Details
File Location:
scripts/vision_executor.py, lines 69–72
Vulnerability Type: Predictable output path and unsafe file creation
Risk Level: Lowpython out_path = f"sandbox_output_{i}_{j}.png" with open(out_path, "wb") as f: f.write(part.inline_data.data) print(f"\nMEDIA: {os.path.abspath(out_path)}")Technical Analysis
Inline data returned by the remote model is written to a predictable filename in the current working directory. Opening the path with
wbsilently truncates any existing file with the same name.The implementation does not use exclusive creation, generate a collision-resistant filename, check whether the destination already exists, or require the user to approve replacement. Although the remote response controls the file contents, the filename is derived from candidate and part indexes rather than directly from attacker-controlled path data. Consequently, this is a constrained overwrite issue rather than an arbitrary-path write.
Attack Path
- An attacker influences the submitted image or prompt, or otherwise causes the Gemini response to include inline image data.
- The user runs the CLI from a directory containing a file named according to the predictable pattern, such as
sandbox_output_0_2.png. - The application iterates over the returned candidate parts and constructs that same output path.
open(out_path, "wb")truncates the existing file.- Model-returned bytes replace the prior contents without warning or confirmation.
Impact Assessment
Exploitation can destroy or replace files matching the
sandbox_output_{i}_{j}.pngnaming pattern in the process's current working directory. The write occurs with the privileges of the user running the CLI.No arbitrary path traversal, privilege escalation, persistence, or overwrite of unrestricted filenames was identified. Practical impact is therefore limited to predictable matching file ...[truncated 38 chars]
- Remediation
View remediation
Remediation Suggestions
- Store generated files in a dedicated output directory selected explicitly by the user.
- Generate collision-resistant names, for example with
uuid.uuid4()ortempfile. - Use exclusive creation mode (
xb) to prevent silent replacement. - If deterministic filenames are required, check for an existing destination and refuse to overwrite it unless the user supplies an explicit
--overwriteoption. - Resolve and validate the destination against the intended output directory before writing.
- Consider atomic file creation and replacement procedures where output integrity is important.