T09 · Insecure Skill Coding Practices
Error
- Location
scripts/apply.sh:120- Finding
LLM-Controlled Path Traversal in Maintenance Operations
- Content
View full analysis
/dev/null || echo "") if [ -z "$SAFE_TASKS" ]; then echo " No safe tasks to apply." else echo "$SAFE_TASKS" | while IFS= read -r task; do TYPE=$(echo "$task" | jq -r '.type') TARGET=$(echo "$task" | jq -r '.target') ACTION=$(echo "$task" | jq -r '.action') echo " Processing: $TYPE $TARGET" case "$TYPE" in archive) # Move to archive directory if [ -f "$WORKSPACE/$TARGET" ]; then BASENAME=$(basename "$TARGET") mkdir -p "$WORKSPACE/memory/archive" mv "$WORKSPACE/$TARGET" "$WORKSPACE/memory/archive/$BASENAME" echo " ✓ Archived to memory/archive/$BASENAME" else echo " ✗ File not found: $TARGET" fi ;; ``` The unrestricted operations continue in all mode: ```bash jq -c '.maintenance_suggestions[]' "$REVIEW_FILE" | while IFS= read -r task; do TYPE=$(echo "$task" | jq -r '.type') TARGET=$(echo "$task" | jq -r '.target') ACTION=$(echo "$task" | jq -r '.action') echo " Processing: $TYPE $TARGET" case "$TYPE" in archive) if [ -f "$WORKSPACE/$TARGET" ]; then BASENAME=$(basename "$TARGET") mkdir -p "$WORKSPACE/memory/archive" mv "$WORKSPACE/$TARGET" "$WORKSPACE/memory/archive/$BASENAME" echo " ✓ Archived" else echo " ✗ Not found" fi ;; rename) # Parse "old -> new" from action OLD= ...[truncated 2526 chars]- Remediation
View remediation