T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/tts.py:83- Finding
Predictable shared temporary files expose conversation data and permit symlink attacks
- Content
View full analysis
str: """Get the last message sent by the assistant.""" try: if os.path.exists(LAST_MSG_FILE): with open(LAST_MSG_FILE, "r", encoding="utf-8") as f: return f.read().strip() except Exception: pass return "" def save_last_message(text: str): """Save the last message.""" try: with open(LAST_MSG_FILE, "w", encoding="utf-8") as f: f.write(text) except Exception: pass ``` ### Technical Analysis The Skill stores generated audio and cached conversation text under fixed, globally predictable names in `/tmp`. Standard calls to `open()` follow symbolic links, and these writes neither use exclusive file creation nor explicitly enforce owner-only permissions. An attacker with local access can create one of these paths before the Skill runs, replace it between operations, or make it a symbolic link to another filesystem object. If the Skill runs with greater privileges than the attacker, writing through such a link can truncate or overwrite a file accessible to the Skill. The single audio path and single message-cache path are also shared by every invocation. Concurrent requests can overwrite one another, resulting in one user's audio or cached text being read or sent duri ...[truncated 1513 chars]- Remediation
View remediation