T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/apply.sh:120
- Finding
- LLM-Controlled Path Traversal in Maintenance Operations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/apply.sh:120-138`, `scripts/apply.sh:193-229` **Vulnerability Type**: Path traversal and unsafe use of untrusted model output **Risk Level**: High ### Vulnerable Code ```bash SAFE_TASKS=$(jq -c '.maintenance_suggestions[] | select(.safe_to_auto == true)' "$REVIEW_FILE" 2>/dev/null || echo "") if [ -z "$SAFE_TASKS" ]; then echo " No safe tasks to apply." else echo "$SAFE_TASKS" | while IFS= read -r task; do TYPE=$(echo "$task" | jq -r '.type') TARGET=$(echo "$task" | jq -r '.target') ACTION=$(echo "$task" | jq -r '.action') echo " Processing: $TYPE $TARGET" case "$TYPE" in archive) # Move to archive directory if [ -f "$WORKSPACE/$TARGET" ]; then BASENAME=$(basename "$TARGET") mkdir -p "$WORKSPACE/memory/archive" mv "$WORKSPACE/$TARGET" "$WORKSPACE/memory/archive/$BASENAME" echo " ✓ Archived to memory/archive/$BASENAME" else echo " ✗ File not found: $TARGET" fi ;; ``` The unrestricted operations continue in all mode: ```bash jq -c '.maintenance_suggestions[]' "$REVIEW_FILE" | while IFS= read -r task; do TYPE=$(echo "$task" | jq -r '.type') TARGET=$(echo "$task" | jq -r '.target') ACTION=$(echo "$task" | jq -r '.action') echo " Processing: $TYPE $TARGET" case "$TYPE" in archive) if [ -f "$WORKSPACE/$TARGET" ]; then BASENAME=$(basename "$TARGET") mkdir -p "$WORKSPACE/memory/archive" mv "$WORKSPACE/$TARGET" "$WORKSPACE/memory/archive/$BASENAME" echo " ✓ Archived" else echo " ✗ Not found" fi ;; rename) # Parse "old -> new" from action OLD= ...[truncated 2526 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat all model output as untrusted data, including `safe_to_auto`. 2. Reject absolute paths, empty paths, control characters, and any path containing a `..` component. 3. Canonicalize the source with `realpath` and verify that it starts with the canonical `$WORKSPACE/memory/` prefix. 4. Resolve and validate the destination independently before every `mv`. 5. Reject symbolic links or validate their fully resolved targets. 6. Restrict safe mode to locally derived operations over files discovered by trusted code; do not let the model assign safety status. 7. Validate review JSON against a strict schema and an allowlist of operation types. 8. For rename operations, use a structured destination field rather than parsing free-form natural language from `action`. 9. Present canonical source and destination paths to the user before confirmation. 10. Add tests for absolute paths, traversal paths, symbolic-link escapes, malformed JSON, and model-generated unsafe tasks. ]]>