T09 · Insecure Skill Coding Practices
Warning
- Location
src/state-store.ts:95- Finding
Path Traversal Through Unvalidated Workflow Identifiers
- Content
View full analysis
(p); } saveWorkflow(state: WorkflowState, expectedVersion: number): WorkflowState { this.acquireLock(); try { const current = this.loadWorkflow(state.workflowId); if (current && current.stateVersion !== expectedVersion) { throw new Error( `Version conflict: expected ${expectedVersion}, found ${current.stateVersion}. ` + `Re-load the workflow and retry.` ); } const updated: WorkflowState = { ...state, stateVersion: expectedVersion + 1, updatedAt: new Date().toISOString(), }; this.writeJson(this.workflowPath(state.workflowId), updated); this.updateIndex(updated); return updated; } finally { this.releaseLock(); } } ``` The affected identifier is accepted by the public tool interface and passed to the storage layer. For example: ```ts case "status": { result = engine.status(params.workflowId); break; } ``` ### Technical Analysis New workflow identifiers are securely generated with `crypto.randomUUID()`, but identifiers supplied to subsequent actions are not required to use the same UUID format. The tool schema accepts any string, and the entry point generally checks only whether the value is present. `workflowPath()` concatenates the untrusted value with `.json` and passes it to `path.join()`. Path ...[truncated 3521 chars]- Remediation
View remediation