T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.MD:40
- Finding
- Unsanitized Story Title Used as an Output Filename<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.MD`, lines 40–59 **Vulnerability Type**: Path traversal and unsafe file creation through an untrusted filename **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown - Latest TXT file inside: E:\AI\openclaw-tpt\input\TXT\ TXT structure assumed: - First line = TITLE - Remaining content = STORY CONTEXT - Reference images: All PNG files inside: E:\AI\openclaw-tpt\input\cover\ --- ## Outputs - Generated PNG image - Saved to: E:\AI\openclaw-tpt\output\COVER\ - Filename: <TITLE>.png ``` The unsafe data flow is repeated in the procedure at lines 72–89: ```markdown 5. Read latest TXT file from: E:\AI\openclaw-tpt\input\TXT\ - Extract TITLE (first line) - Extract STORY CONTEXT (remaining content) 6. Fill the TITLE field in the tool. 7. Fill STORY CONTEXT field. 8. Click "Generate Cover". 9. Wait for generated image preview to appear. 10. Download generated image. 11. Save image to: E:\AI\openclaw-tpt\output\COVER\ Filename: <TITLE>.png ``` ### Technical Analysis The skill treats the first line of the latest TXT file as an untrusted `TITLE` and directly reuses it as the downloaded image's filename. No instruction requires validation, basename extraction, canonicalization, length limits, reserved-name checks, or destination containment verification. On Windows, a crafted title may contain path separators, traversal components such as `..\`, drive or UNC path syntax, control characters, trailing dots or spaces, or reserved device names. Depending on how the browser automation implements the save operation, these values may cause the generated file to be written outside the intended `output\COVER` directory, overwrite an existing PNG, or make the workflow fail. Browser-level filename normalization may limit exploitation in some implementations, but the skill itself does not establish or verify that protection. ### Attack Path 1. An attacker or untrusted ...[truncated 1348 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat the extracted title as display text only and derive a separate safe filename. 2. Remove or replace `/`, `\`, `..`, colons, control characters, and all other characters prohibited or dangerous in Windows filenames. 3. Reject absolute paths, drive-prefixed paths, UNC paths, empty names, trailing dots or spaces, and Windows reserved names such as `CON`, `PRN`, `AUX`, `NUL`, `COM1`, and `LPT1`. 4. Enforce a conservative filename length limit and use a fallback name when sanitization produces an empty value. 5. Construct the destination from the trusted output directory and sanitized basename, resolve it to a canonical path, and verify that the result remains beneath `E:\AI\openclaw-tpt\output\COVER\`. 6. Prevent silent overwrite by appending a unique suffix, failing safely when the destination exists, or requiring explicit confirmation. 7. Verify after download that the resulting file exists inside the approved output directory and reject any result located elsewhere. A safe rule should resemble: ```text safe_title = sanitize_to_basename(TITLE) destination = canonical_join(OUTPUT_DIRECTORY, safe_title + ".png") require destination is a child of canonical(OUTPUT_DIRECTORY) require destination does not already exist ``` ]]>