T09 · Insecure Skill Coding Practices
Error
- Location
scripts/agent_creator.py:105- Finding
Unvalidated Agent ID Enables Path Traversal and Sensitive File Placement
- Content
View full analysis
- Remediation
View remediation
None: if not AGENT_ID_PATTERN.fullmatch(agent_id): raise ValueError( "Agent ID must contain only lowercase letters, digits, and single hyphens" ) ``` 2. Explicitly reject absolute paths, path separators, `.` components, and `..` components. 3. Resolve every generated destination and verify that it remains below its intended root: ```python def safe_child(root: Path, *parts: str) -> Path: resolved_root = root.resolve() candidate = resolved_root.joinpath(*parts).resolve() if not candidate.is_relative_to(resolved_root): raise ValueError("Generated path escapes its permitted root") return candidate ``` 4. Use separate containment checks for workspace and runtime paths. 5. Create copied authentication files with restrictive permissions, such as owner read/write only, rather than relying solely on the current umask. 6. Perform all validation before creating directories, copying files, or updating configuration. 7. Add tests for absolute paths, `../` traversal, embedded separators, empty identifiers, repeated hyphens, and valid lowercase identifiers. ]]>