T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:10
- Finding
- Path Traversal Through Unvalidated Filename Parameter## Vulnerability Details **File Location**: `SKILL.md`, lines 10, 29, 45, and 108 **Vulnerability Type**: Path traversal and unintended local file disclosure **Risk Level**: High The skill accepts a caller-controlled `filename` and directly interpolates it into input and output paths: ```text - filename: 文件名（例如：xxx.txt） {input_dir}/{filename} {output_dir}/{filename_去掉扩展名} {output_dir}/{filename_去掉扩展名}/figure_{index}.png ``` ### Technical Analysis The instructions do not require the agent to validate that `filename` is a simple file name. There is no rejection of absolute paths, path separators, `..` traversal segments, symbolic links, unexpected extensions, or resolved paths outside the configured directories. Although the skill describes the input and output directories as fixed, direct path interpolation does not enforce that boundary. A value containing traversal components could resolve outside `/home/xie/桌面/analysis`. The resulting content would be parsed as image prompts and sent to Gemini, creating a potential external disclosure channel for unintended local files. The same unvalidated value is used to derive an output directory beneath `/home/xie/桌面/images`. Traversal components could therefore redirect directory creation and predictable `figure_{index}.png` writes outside the intended output tree, subject to the agent's filesystem permissions. ### Attack Path 1. An attacker or untrusted caller supplies a `filename` containing traversal components instead of a simple `.txt` basename. 2. The agent concatenates that value with the configured input directory without canonicalization or containment validation. 3. The resulting path resolves to a readable file outside the intended analysis directory. 4. The agent reads and parses the unintended file. 5. Parsed content is submitted to Gemini as image-generation prompts, potentially disclosing local information to an external service. 6. The agent derives the ...[truncated 850 chars]
- Remediation
- ## Remediation Suggestions 1. Require `filename` to be a basename rather than a path. 2. Apply a strict allowlist, such as `^[A-Za-z0-9._-]+\.txt$`. 3. Reject absolute paths, path separators, null bytes, and `..` components. 4. Resolve the candidate input path to its canonical form and verify that it remains beneath `/home/xie/桌面/analysis`. 5. Derive the output directory only from a sanitized basename with the extension removed. 6. Canonicalize the output parent and verify containment beneath `/home/xie/桌面/images` before creating directories or writing files. 7. Refuse symbolic-link input files and symbolic-link output directories unless they have been explicitly approved. 8. Use non-overwriting file creation or require confirmation before replacing existing output files. 9. Confirm the selected input file and external disclosure scope with the user before submitting its content to Gemini. 10. Stop with an explicit error state whenever validation or containment checks fail.