T09 · Insecure Skill Coding Practices
- Location
SKILL.md:29- Finding
Predictable Shared Temporary File Enables Data Disclosure and File Manipulation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 29-41
Vulnerability Type: Unsafe temporary-file handling
Risk Level: MediumVulnerable Code
markdown Write a compressed problem summary to a temp file, then read it back. 1. Collect the essential facts into a structured summary 2. Write to a temp file 3. Read it back 4. Answer the fresh analysis questions 5. Continue based on the reframe 6. **验证**: 确认 reframe 后的方案确实简化了问题。如果仍然复杂或绕圈子，此 skill 需要更新——加载 skill-manager 修复。 ## Summary Template Write this to `/tmp/reframe.md`:Technical Analysis
The Skill requires the agent to store conversation-derived information at the fixed, predictable path
/tmp/reframe.md. The summary may contain project paths, errors, operational constraints, attempted solutions, or other sensitive contextual information.The instructions do not require:
- Unique per-run filenames
- Exclusive file creation
- Restrictive file permissions
- File ownership validation
- Symbolic-link rejection
- Integrity checks before reading
- Secure deletion after use
On a shared system, another local process or user may predict and pre-create this path. If the file-writing tool follows symbolic links, the write could be redirected to another file that the agent is permitted to modify. An attacker could also replace or alter the summary before it is read back, causing untrusted content to influence subsequent analysis.
Attack Path
- A local attacker predicts that the Skill will use
/tmp/reframe.md. - Before invocation, the attacker creates that file or places a symbolic link at that path.
- The agent writes conversation-derived information to the attacker-controlled file or linked destination.
- The attacker reads the resulting summary, potentially exposing sensitive contextual data.
- Alternatively, the attacker modifies the file before the agent reads it back.
- The agent consumes the manipulated text as its reframed problem summary, potentially contam ...[truncated 791 chars]
- Remediation
View remediation
Remediation Suggestions
Prefer keeping the compressed summary in the agent's active context rather than persisting it to the filesystem.
If file-backed storage is essential:
- Create a cryptographically unpredictable, per-invocation temporary filename in a private directory.
- Use an operating-system secure temporary-file API with exclusive creation enabled.
- Set permissions so only the current user can read or write the file.
- Reject symbolic links and verify the file's ownership and type before writing and reading.
- Keep the file descriptor open between writing and reading to reduce replacement races.
- Do not include secrets, credentials, or unnecessary private context in the summary.
- Delete the file immediately after use, including on error paths.
- Avoid sharing the same temporary path across users, sessions, or concurrent Skill executions.