T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/weather.sh:7- Finding
Predictable Shared Temporary Cache Allows Symlink-Based File Overwrite
- Content
View full analysis
/dev/null || stat -c %Y "$cache_file" 2>/dev/null || echo "0") local age=$((now - mtime)) if [[ $age -lt $CACHE_TTL ]]; then cat "$cache_file" return 0 fi fi return 1 } set_cache() { local key="$1" local data="$2" echo "$data" > "$CACHE_DIR/${key}.cache" } ``` ### Technical Analysis The script stores cache files in a fixed, predictable directory under the globally shared `/tmp` namespace. It creates that directory with `mkdir -p` but does not verify its owner, type, or permissions. If the directory already exists, the script accepts it without validation. Cache filenames are also predictable, and `set_cache` writes to them using ordinary shell redirection. Shell redirection follows symbolic links. Consequently, a local attacker can prepare a cache filename as a symbolic link to another file before the Skill writes its response. The vulnerability does not bypass operating-system file permissions: the target must be writable by the user running the Skill. However, if the Skill is invoked by a different or more privileged account, the write occurs with that account's privileges. ### Attack Path 1. A local attacker creates `/tmp/china-weather-cache` before the victim runs the Skill and configures it so the victim can write into it. 2. The attacker predicts the cache filename for a city, such as `current_beijing.cache`. 3. The attacker creates that path as a symbolic link to a file writ ...[truncated 1103 chars]- Remediation
View remediation
&2 exit 1 fi set_cache() { local key="$1" local data="$2" local target="$CACHE_DIR/${key}.cache" local temporary [[ ! -L "$target" ]] || return 1 temporary=$(mktemp "$CACHE_DIR/.cache.XXXXXX") || return 1 printf '%s\n' "$data" > "$temporary" mv -f -- "$temporary" "$target" } ``` Cache keys should additionally be generated from a collision-resistant encoding or digest of the complete normalized city value. ]]>