T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/create_agent.sh:4
- Finding
- Path Traversal and Arbitrary SKILL.md File Overwrite via Unvalidated Agent Name## Vulnerability Details **File Location**: `scripts/create_agent.sh`, lines 4–17 **Vulnerability Type**: Path traversal and unsafe file creation **Risk Level**: Medium ```bash NAME=$1 ROLE=$2 DIR="agents/$NAME" mkdir -p "$DIR/inbox" "$DIR/outbox" "$DIR/workspace" cat <<EOM > "$DIR/SKILL.md" --- name: $NAME description: $ROLE --- # Mission You are $NAME. Your role is: $ROLE. Read instructions from ./inbox and write outputs to ./outbox. EOM ``` ### Technical Analysis The first command-line argument is used directly as part of a filesystem path without validation or canonical-path containment checks. Although quoting prevents shell word splitting and direct shell metacharacter injection, it does not prevent path components such as `../`. An attacker able to invoke the script can therefore cause `DIR` to resolve outside the intended `agents/` directory. The script creates directories at the resulting location and writes or truncates a file named `SKILL.md`. The output redirection also follows an existing symbolic link, so a pre-positioned `SKILL.md` symlink can redirect the write to another file accessible to the invoking user. ### Attack Path 1. The attacker obtains the ability to invoke `scripts/create_agent.sh` and supply its arguments. 2. The attacker provides an agent name containing traversal components, for example: ```bash ./scripts/create_agent.sh "../../attacker-controlled-location" "Injected role" ``` 3. The generated path becomes `agents/../../attacker-controlled-location`. 4. The script creates `inbox`, `outbox`, and `workspace` directories outside the intended `agents/` root. 5. The script creates or truncates `attacker-controlled-location/SKILL.md` using attacker-controlled name and role content. 6. If the attacker can pre-create `SKILL.md` as a symbolic link, the redirection follows that link and overwrites its writable target. ### Impact Assessment Exploitation u ...[truncated 692 chars]
- Remediation
- ## Remediation Suggestions - Require both arguments and terminate on missing or invalid input. - Restrict agent names to a safe identifier format, such as `^[A-Za-z0-9_-]+$`. - Construct the destination from a fixed absolute agents root. - Canonicalize the destination and verify that it remains strictly beneath the intended root before creating anything. - Reject existing destination files and symbolic links rather than following or overwriting them. - Use safe exclusive file creation when replacing an existing `SKILL.md` is not required. - Enable defensive shell behavior with `set -euo pipefail`. - Consider validating or safely encoding `NAME` and `ROLE` before embedding them in YAML and agent instructions. Example validation: ```bash #!/usr/bin/env bash set -euo pipefail if [[ $# -ne 2 ]]; then echo "Usage: $0 AGENT_NAME ROLE_DESCRIPTION" >&2 exit 2 fi NAME=$1 ROLE=$2 if [[ ! "$NAME" =~ ^[A-Za-z0-9_-]+$ ]]; then echo "Invalid agent name" >&2 exit 2 fi ROOT="$(pwd -P)/agents" DIR="$ROOT/$NAME" mkdir -p -- "$ROOT" if [[ -e "$DIR/SKILL.md" || -L "$DIR/SKILL.md" ]]; then echo "Refusing to overwrite an existing SKILL.md" >&2 exit 1 fi mkdir -p -- "$DIR/inbox" "$DIR/outbox" "$DIR/workspace" ```