T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:110- Finding
Predictable Temporary File Exposes Sensitive Intelligence Dossiers
- Content
View full analysis
/tmp/nyne_response.json STATUS=$(jq -r '.data.status' /tmp/nyne_response.json) echo "Status: $STATUS ($SECONDS_WAITED seconds elapsed)" if [ "$STATUS" = "completed" ]; then jq '.data.result' /tmp/nyne_response.json break elif [ "$STATUS" = "failed" ]; then echo "Research failed." jq . /tmp/nyne_response.json ``` The same fixed path is also used by the polling example at `SKILL.md:239-253` and referenced throughout `SKILL.md:365-393`. ### Technical Analysis The API response is written to the predictable shared path `/tmp/nyne_response.json`. The documented response can contain email addresses, phone numbers, social profiles, employment and education history, political leanings, psychographic details, relationships, and other sensitive personal information. The instructions do not securely create the file, set restrictive permissions, verify that the path is a regular file owned by the current user, or remove the file after use. Because shell redirection follows symbolic links, a local attacker may be able to pre-create the path as a symlink and redirect the write. Depending on operating-system protections and process privileges, this could overwrite another writable file. A local process may also monitor or read the predictable file if its permissions allow access. The file remains on disk after processing, increasing the period during which the dossier can be recovered or accessed. ### Attack Path 1. An attacker with local access monitors the predictable `/tmp/nyne_response.json` path or creates it before the victi ...[truncated 1180 chars]- Remediation
View remediation
"$RESPONSE_FILE" STATUS=$(jq -r '.data.status' "$RESPONSE_FILE") ``` Additional hardening measures: - Never use a constant filename in a shared temporary directory. - Check that temporary-file creation succeeds before sending the API request. - Quote every reference to the generated path. - Keep `umask 077` active while handling dossier data. - Avoid writing the full response to disk where streaming or in-memory processing is practical. - Redact unnecessary personal fields before displaying or retaining results. - Define and enforce an explicit retention policy for any intentionally saved dossier. ]]>