T09 · Insecure Skill Coding Practices
Warning
- Location
eml_cleaner.py:49- Finding
Predictable Shared Temporary File Enables Symlink Attacks and Email Data Exposure
- Content
View full analysis
/tmp/eml_cleaned.txt ``` `eml_cleaner.py:49-50`: ```python if output_path: with open(output_path, 'w', encoding='utf-8') as f: f.write(result) ``` ### Technical Analysis The skill mandates use of the fixed, globally predictable path `/tmp/eml_cleaned.txt` for extracted email content. The Python script then opens that path with standard write mode. This operation follows symbolic links and truncates an existing target. On a multi-user system, another local process may create the predictable path before the skill runs or attempt to replace it during processing. If the path is a symbolic link, the script may write the extracted email data to the linked file, subject to the operating system's symlink protections and the Agent process's permissions. The fixed filename also causes all runs and sessions to share the same output location. This creates race conditions, cross-session content contamination, and potential disclosure of sensitive email headers and bodies. The resulting file permissions depend on the process umask and may allow other local users to read the extracted content. ### Attack Path 1. A local attacker predicts that the skill will write to `/tmp/eml_cleaned.txt`. 2. Before preprocessing starts, the attacker creates that path as a symbolic link to a file writable by the Agent process, or races to replace the path. 3. The Agent executes the preprocessing command required by `SKILL.md`. 4. `open(output_path, 'w')` follows the symbolic link and truncates or overwrites the linked target with attacker-influenced email content. 5. Depending on the target and Agent privileges, this can corrupt application or user files. 6. Alternative ...[truncated 1209 chars]- Remediation
View remediation