T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/extract-skill.sh:97- Finding
Symbolic-Link Bypass of Output Directory Containment
- Content
View full analysis
"$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The script attempts to confine generated skills to a relative directory by rejecting absolute paths and lexical `..` path segments. This validation does not resolve the destination to its canonical filesystem path and does not reject symbolic links. A relative path can therefore pass the lexical checks while resolving outside the current project. For example, if `./skills` or a component supplied through `--output-dir` is a symbolic link to another writable directory, `mkdir -p` and shell redirection follow that link. The script then creates a skill directory and `SKILL.md` outside its documented containment boundary. The skill-name validation prevents direct path separators in the skill name, and the existing-directory check limits straightforward overwrites. Nevertheless, neither protection prevents out-of-project file creation through a symbolic-linked parent directory. ### Attack Path 1. An attacker who can modify the project workspace creates a symbolic link in an accepted relative output path, for example: ```bash ln -s /tmp/attacker-controlled-output skills ``` 2. A user or agent runs the documented write operation: ```bash ./scripts/extract-skill.sh generated-skill --write ...[truncated 1287 chars]- Remediation
View remediation