T09 · Insecure Skill Coding Practices
- Location
SKILL.md:29- Finding
Predictable Shared Temporary Directory Used with Unguarded Recursive Cleanup
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 29-32
Vulnerability Type: Unsafe temporary-directory handling
Risk Level: Medium
Classification: T09: Insecure Skill Coding PracticesVulnerable Code
bash # Fetch the remote Skill into a temporary directory without installing it clawdhub install <skill-name> --dir /tmp/skill-audit-tmp # Delete it after completing the audit rm -rf /tmp/skill-audit-tmpTechnical Analysis
The documented pre-install audit workflow uses the fixed, globally predictable path
/tmp/skill-audit-tmp. Shared temporary directories can be influenced by other local users or processes. The workflow does not create a uniquely named private directory, verify its ownership or canonical path, enforce restrictive permissions, or validate its type before passing it toclawdhuband recursively deleting it.A local attacker could prepare or modify the predictable path before the workflow runs. Depending on the behavior of
clawdhub, attacker-controlled files, links, permissions, or directory contents could interfere with package retrieval and inspection. The unconditionalrm -rfalso risks deleting unexpected content if the path is replaced or otherwise manipulated.The command retrieves a remote package before it is audited. The documentation does not require lifecycle hooks or automatic execution to be disabled. If
clawdhub installexecutes package-controlled hooks, this would undermine the purpose of pre-install review. The available project files do not establish whether such execution actually occurs, so this is a hardening concern rather than a confirmed remote-execution finding.Attack Path
- A local attacker predicts that the auditor will use
/tmp/skill-audit-tmp. - The attacker creates or manipulates that path and places attacker-controlled content, links, or permissions within it.
- The user follows the documented workflow and invokes ...[truncated 1398 chars]
- A local attacker predicts that the auditor will use
- Remediation
View remediation
Remediation Suggestions
Replace the fixed path with a private, uniquely generated temporary directory and guarantee guarded cleanup:
bash audit_dir="$(mktemp -d "${TMPDIR:-/tmp}/skill-audit.XXXXXXXX")" || exit 1 chmod 700 "$audit_dir" cleanup() { case "$audit_dir" in "${TMPDIR:-/tmp}"/skill-audit.*) [ -d "$audit_dir" ] && [ ! -L "$audit_dir" ] && rm -rf -- "$audit_dir" ;; *) printf '%s\n' "Refusing to remove unexpected path" >&2 return 1 ;; esac } trap cleanup EXIT INT TERM clawdhub install <skill-name> --dir "$audit_dir"Additional hardening should include:
- Verify that the generated directory is owned by the current user and is not a symbolic link.
- Resolve and validate its canonical path before recursive cleanup.
- Use restrictive permissions such as mode
0700. - Pass paths after
--where supported to prevent option interpretation. - Configure
clawdhubto download or unpack without running lifecycle hooks, setup scripts, or package code. - Audit an immutable snapshot or record file hashes after retrieval so local modifications cannot silently alter the reviewed content.
- Abort if the temporary directory already exists or its ownership, permissions, or type differ from expectations.