T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/create_ppt.sh:11- Finding
Unrestricted output filename permits path traversal and arbitrary file overwrite
- Content
View full analysis
/dev/null ``` ### Technical Analysis The second positional argument is accepted as an output filename and concatenated directly with `$HOME/Desktop/`. The script does not: - Reduce the supplied value to a filename with `basename`. - Reject `..` path components. - Reject directory separators. - Canonicalize and validate the resulting destination. - Verify that the resolved destination remains inside the Desktop directory. - Prevent replacement of an existing file. Consequently, an input such as `../../some/writable/file.pdf` produces a destination containing traversal components. If the `openclaw browser download` implementation resolves these components normally, the downloaded file can be written outside the intended Desktop directory. This issue does not provide additional operating-system privileges. File access remains limited to locations writable by the account running the Skill. ### Attack Path 1. An attacker influences the output filename passed as the script's second argument. 2. The attacker supplies a traversal value such as `../../target.pdf`. 3. The script constructs `$HOME/Desktop/../../target.pdf` without validation. 4. The browser CLI resolves the traversal components when writing the download. 5. An existing file at the resolved location may be overwritten, or a new file may be created there, subject to the invoking user's permissions. ### Impact Assessment Successful exploitation can write or overwrite files outside `~/Desktop`. The scope includes files writable by the user executing the Skill ...[truncated 208 chars]- Remediation
View remediation
&2 exit 1 fi DESKTOP_PATH="$(cd "$HOME/Desktop" && pwd -P)" OUTPUT_PATH="$DESKTOP_PATH/$OUTPUT_NAME" if [ -e "$OUTPUT_PATH" ]; then echo "ERROR: Output file already exists: $OUTPUT_PATH" >&2 exit 1 fi ``` ]]>