T09 · Insecure Skill Coding Practices
Error
- Location
kindroid.sh:8- Finding
Predictable Temporary File Permits Symlink-Based File Overwrite
- Content
View full analysis
"$RATE_LIMIT_FILE" } ``` ### Technical Analysis The rate-limit state is stored at a fixed, globally predictable path in the shared `/tmp` directory. The script does not securely create the file, reject symbolic links, verify ownership, or confirm that the existing object is a regular file controlled by the current user. Shell redirection follows symbolic links. Consequently, another local user can create `/tmp/kindroid_last_call` as a symbolic link to any file that the victim running the Skill is permitted to overwrite. When the Skill executes `date +%s > "$RATE_LIMIT_FILE"`, the linked target is truncated and replaced with a timestamp. The script also reads existing file content and uses it in Bash arithmetic without first verifying that it contains only a valid integer. Attacker-controlled content can therefore trigger arithmetic parsing errors or unexpected expression handling, providing an additional denial-of-service vector. The shared file is also not protected by locking, so concurrent executions can race with one another. ### Attack Path 1. A local attacker determines that the victim uses the Kindroid Skill. 2. Before the victim runs the CLI, the attacker creates a symbolic link at the predictable path: ```bash ln -s /path/to/victim-writable-file /tmp/kindroid_last_call ``` 3. The victim invokes `kindroid.sh send`, `break`, or `status`. 4. `api_call` invokes `check_rate_limit`. 5. The final redirection follows the ...[truncated 933 chars]- Remediation
View remediation