T09 · Insecure Skill Coding Practices
Error
- Location
all_skills.py:253- Finding
Unrestricted File Deletion Through Caller-Controlled Cleanup Paths
- Content
View full analysis
Vulnerability Details
File Location:
all_skills.py:13-35,all_skills.py:253-258, andall_skills.py:276-321
Vulnerability Type: Unrestricted file deletion caused by insufficient path validation
Risk Level: HighVulnerable Code
python def init_env(base_path="./computer_skill"): """ Initialize the environment: create the directory structure, clear temp, and check template directories. """ dirs = [ f"{base_path}", f"{base_path}/templates", f"{base_path}/templates/desktop", f"{base_path}/templates/taskbar", f"{base_path}/templates/system", f"{base_path}/templates/wechat", f"{base_path}/temp" ] for d in dirs: if not os.path.exists(d): os.makedirs(d) print(f"Created directory: {d}") # Clear temp temp_dir = f"{base_path}/temp" for f in os.listdir(temp_dir): os.remove(os.path.join(temp_dir, f))python def clean_temp(temp_dir="./computer_skill/temp"): """ Delete temporary screenshots and release storage. """ for f in os.listdir(temp_dir): os.remove(os.path.join(temp_dir, f)) print("Temporary directory cleared") return TrueThe main workflow propagates its caller-controlled
base_pathinto the cleanup operation:python def vision_auto_main(target_text, category=None, template_name=None, action='click', input_text=None, loop=False, base_path="./computer_skill"): # ... if not result: if not loop: return False clean_temp(f"{base_path}/temp") loop_restart() continue # ... clean_temp(f"{base_path}/temp")Technical Analysis
The cleanup functions delete every ordinary file found in a directory without verifying that the directory is an applica ...[truncated 2023 chars]
- Remediation
View remediation
Remediation Suggestions
- Use a fixed, application-owned temporary root rather than accepting arbitrary cleanup directories.
- Create temporary storage with Python's
tempfilefacilities and retain the exact directory handle or resolved path. - Canonicalize both the trusted root and requested target with
pathlib.Path.resolve(). - Reject cleanup unless the resolved target is strictly contained within the trusted Skill-owned root.
- Explicitly reject dangerous targets such as the filesystem root, user home, project root, and pre-existing directories not created by the Skill.
- Create an ownership marker inside the temporary directory and verify it before deletion.
- Track files created by the current execution and delete only those files instead of deleting every directory entry.
- Handle symbolic links safely and do not follow a link that resolves outside the trusted temporary root.
- Apply least-privilege filesystem permissions to the process account.
- Add tests covering absolute paths, parent traversal, symbolic links, root directories, home directories, and unrelated pre-existing
tempdirectories.
A hardened implementation should enforce containment before removing tracked files:
python from pathlib import Path SKILL_ROOT = (Path.cwd() / "computer_skill").resolve() TEMP_ROOT = (SKILL_ROOT / "temp").resolve() def clean_temp(): if TEMP_ROOT.parent != SKILL_ROOT: raise ValueError("Invalid temporary directory") for candidate in TEMP_ROOT.iterdir(): resolved = candidate.resolve() if TEMP_ROOT not in resolved.parents: raise ValueError("Cleanup target escapes the temporary directory") if candidate.is_file() and not candidate.is_symlink(): candidate.unlink()