T09 · Insecure Skill Coding Practices
- Location
SKILL.md:72- Finding
User-Controlled Textbook Name May Permit Path Traversal During File Creation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:72-79; duplicated workflow inREADME.md:84-89
Vulnerability Type: Path traversal through an unsanitized filename
Risk Level: MediumVulnerable Instruction
The affected workflow directs the agent to use the submitted book name directly as part of a filesystem path:
text ## Add a New Book 1. Receive textbook contents from text or an image. 2. Convert the contents into JSON. 3. Write the result to: textbooks/<book-name>.jsonThe workflow does not require validation of the user-controlled
book-namevalue or verification that the resolved destination remains inside thetextbooks/directory.Technical Analysis
A user who controls the book name may supply path separators, parent-directory components, an absolute path, control characters, or a name resolving through a symbolic link. If the agent follows the documented path template literally, a name such as
../../workspace/notesproduces a destination equivalent to:text textbooks/../../workspace/notes.jsonPath normalization resolves this outside the intended textbook directory. Appending the
.jsonextension reduces the set of files that can be targeted but does not prevent creation or replacement of JSON files elsewhere in the agent's writable filesystem scope.Exploitation depends on the agent having a file-writing tool and on that tool accepting the resulting path. The reviewed project does not contain executable code that performs the write automatically; the risk arises from the documented agent workflow.
Attack Path
- An attacker asks the skill to add a new textbook.
- The attacker supplies a crafted book name containing traversal components, such as
../../workspace/notes. - The agent converts the supplied textbook data into JSON.
- Following the skill instructions, the agent constructs
textbooks/../../workspace/notes.json. - The fil ...[truncated 758 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not use a user-supplied book title directly as a filename. Generate an internal identifier or sanitized filename instead.
- Apply a strict allowlist permitting only expected letters, digits, spaces, hyphens, and underscores.
- Reject
/,\,.., absolute paths, drive prefixes, null bytes, control characters, and reserved filesystem names. - Resolve the canonical destination path before writing and verify that it is a direct child of the canonical
textbooks/directory. - Reject symbolic-link destinations and avoid following symbolic links during file creation.
- Use exclusive file creation or require explicit confirmation before replacing an existing file.
- Update both
SKILL.mdandREADME.mdso the documented workflow requires validation and path-confinement checks. - Add negative tests covering parent traversal, absolute paths, mixed path separators, encoded separators, Unicode separator lookalikes, and symbolic-link targets.