T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:51- Finding
Predictable Temporary File Allows Symlink-Based File Corruption
- Content
View full analysis
"${f}.tmp" && mv "${f}.tmp" "$f" done ``` ### Technical Analysis The batch-processing command uses the predictable path `${f}.tmp` as a temporary output file. Shell output redirection opens this path before executing Perl and follows symbolic links by default. The code neither creates the temporary file securely nor verifies that the path is a regular file owned by the invoking user. If an attacker can write to the transcript directory, the attacker can create `${f}.tmp` as a symbolic link to another file writable by the user running the conversion. The redirection then truncates that target and writes converted transcript content into it. After successful processing, `mv "${f}.tmp" "$f"` can also replace the original transcript path with the attacker-created symbolic link. The vulnerability is constrained by operating-system permissions: it does not grant privileges beyond those of the user invoking the command. It nevertheless creates an avoidable local symlink race and unintended file-overwrite primitive. ### Attack Path 1. An attacker identifies a transcript that will be processed, such as `interview.txt`. 2. The attacker has write access to the transcript directory and creates `interview.txt.tmp` as a symbolic link to another file writable by the victim user. 3. The victim or Agent runs the documented batch conversion. 4. The shell evaluates `> ...[truncated 843 chars]- Remediation
View remediation
"$tmp"; then mv -- "$tmp" "$f" trap - EXIT HUP INT TERM else rm -f -- "$tmp" trap - EXIT HUP INT TERM exit 1 fi done ``` ]]>