T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/skillguard.py:82- Finding
Out-of-Scope Symlink Targets Are Read During Scanning
- Content
View full analysis
list: files = [] for root, dirs, filenames in os.walk(skill_path): dirs[:] = [d for d in dirs if d not in {"node_modules", ".git", "__pycache__", ".venv", "venv"}] for fname in filenames: files.append(Path(root) / fname) return files ``` ```python def scan_symlinks(files: list, skill_path: Path, result: ScanResult): """Detect symlinks that could point to sensitive files outside the skill directory.""" for f in files: if f.is_symlink(): rel = f.relative_to(skill_path) try: target = f.resolve() except (RuntimeError, OSError): result.add(Finding( severity=SEVERITY_HIGH, category="symlink", message=f"Broken or looping symlink: {rel}", file=str(rel), evidence=f"Raw target: {os.readlink(f)}", )) continue try: target.relative_to(skill_path) severity = SEVERITY_LOW except ValueError: severity = SEVERITY_CRITICAL msg = (f"Symlink escapes skill directory: {rel} -> {target}" if severity == SEVERITY_CRITICAL else f"Internal symlink: {rel} -> {target}") result.add(Finding( severity=severity, category="symlink", message=msg, file=str(rel), evidence=f"Target: {target}", )) ``` ```python for fpath in files: suffix = fpath.suffix.lower() if suffix not in TEXT_EXTENSIONS: continue ...[truncated 2787 chars]- Remediation
View remediation