T09 · Insecure Skill Coding Practices
- Location
SKILL.md:25- Finding
Predictable Plaintext Temporary File Exposes Agent Reasoning
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 25-59
Vulnerability Type: Unsafe temporary-file handling and plaintext storage
Risk Level: MediumVulnerable Code Snippet
markdown Write your current thinking state to a temp file, then read it back. 1. Answer 6 questions and write to a temp file 2. Read it back 3. Critically analyze what you wrote 4. Continue based on the findings Write tool → /tmp/assess-me.md Content: # Assess Me **Goal:** <1-2 sentences> **Progress:** <1-2 sentences> **Gaps:** <1-2 sentences> **Assumptions:** <1-2 sentences> **Blocker:** <1-2 sentences> **Recovery:** <1-2 sentences> After writing, use Read tool to read `/tmp/assess-me.md` back.Technical Analysis
The Skill requires the agent to place its current task state, assumptions, gaps, and blockers in the fixed path
/tmp/assess-me.md. The instructions do not require exclusive file creation, restrictive permissions, symbolic-link checks, content redaction, or deletion after use.A predictable path in a shared temporary directory is vulnerable to race conditions and symbolic-link attacks. An attacker with local access may create the path before execution, monitor it, or replace it with a symbolic link. Depending on the write tool's behavior and the agent process's filesystem privileges, this can disclose sensitive context or redirect the write to another file writable by the agent.
The recorded reasoning may contain user data, filesystem paths, operational details, or other confidential task context. Persisting that information in plaintext unnecessarily expands the exposure surface.
Attack Path
- A local attacker predicts the documented path
/tmp/assess-me.md. - The attacker monitors the path or pre-creates it as a symbolic link to another file.
- A triggering event causes the Skill to perform its required self-assessment.
- The agent ...[truncated 865 chars]
- A local attacker predicts the documented path
- Remediation
View remediation
Remediation Suggestions
- Avoid writing internal reasoning or sensitive task state to disk unless persistence is strictly necessary.
- Keep the assessment in process memory and return only a concise, sanitized summary.
- If temporary storage is unavoidable, create a unique per-session file using a cryptographically unpredictable name.
- Create the file atomically with exclusive-create semantics and permissions restricted to the current user, such as mode
0600. - Reject symbolic links and verify that the resulting file is a regular file owned by the expected account.
- Store only the minimum required information and redact credentials, tokens, personal data, and sensitive paths.
- Delete the temporary file in a guaranteed cleanup operation immediately after it is read.
- Prefer a private runtime directory owned by the agent account instead of a globally shared temporary directory.