T09 · Insecure Skill Coding Practices
- Location
references/routing.md:36- Finding
Unrestricted Local File Inclusion Through Document References
- Content
View full analysis
Vulnerability Details
File Location:
references/routing.md, lines 36–62
Vulnerability Type: Unrestricted local-file inclusion
Risk Level: MediumVulnerable Instructions
text 步骤2：解析文档中的索引引用 - 查找对子模块需求的引用（如"详见 requirements/01-auth.md"） - 查找目录结构（如"需求文档目录：docs/requirements/"） - 查找链接引用（如"[认证需求](./requirements/01-auth.md)"） - Word文档中的目录引用（如"认证模块需求见附件01-auth.docx"） 步骤3：读取所有被引用的子模块需求文档 - 支持混合格式（主文档是Word，子模块是Markdown等） 步骤4：合并所有需求内容进行分析text **识别模式**： - 相对路径引用：`./requirements/01-auth.md`、`../requirements/01-auth.md` - 绝对路径引用：`/docs/requirements/01-auth.md` - 目录引用：`requirements/`、`docs/requirements/` - 锚点引用：`#认证模块`、`##用户管理` - 附件引用：`附件01-auth.docx`、`详见附件` - 跨格式引用：`认证需求见 requirements/01-auth.md` **处理原则**： - 主文档包含索引时，必须读取所有被引用的子模块 - 子模块需求是主文档的补充，不能忽略 - 支持混合格式（主文档和子模块可以是不同格式） - 合并所有需求后，再进行后续的测试设计流程Technical Analysis
The workflow treats paths embedded in an imported requirements document as trusted file-selection instructions. It explicitly recognizes relative paths, parent-directory references, absolute paths, and directory references, then requires the Agent to read every referenced document and merge its contents into the testing context.
No instruction constrains resolved paths to the directory containing the user-selected requirements document. There is also no canonical-path validation, symlink check, path allowlist, or separate user confirmation for files discovered through document content.
Consequently, an independently supplied or modified requirements document can direct an Agent with
Readaccess toward unrelated local files. This crosses the authorization boundary between the document the user selected and other files accessible to the Agent.Attack Path
- An attacker creates or modifies a requirements document that a victim imports into the Skill.
- The attacker embeds a reference to an unrelated local path, such as a parent-directory path, absolute path, or directory reference.
- The Skill follo ...[truncated 1216 chars]
- Remediation
View remediation
Remediation Suggestions
- Establish an explicit document root from the file or directory selected by the user.
- Canonicalize every discovered reference before opening it.
- Reject absolute paths and any relative path whose canonical destination falls outside the authorized document root.
- Detect and reject symbolic-link escapes from the authorized root.
- Do not recursively read entire directories merely because an imported document names them.
- Maintain an allowlist of supported document extensions and reject device files, sockets, and other non-regular files.
- Present files discovered through document references to the user and require explicit approval before reading anything outside the initially selected set.
- Track reference depth and visited files to prevent recursive-reference loops.
- Keep unrelated file contents out of generated prompts and reports, and apply output redaction for recognized secrets as a defense-in-depth measure.