T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/extract_chapters.py:126
- Finding
- Hard-Coded Access to Personal Files Outside the Project Boundary## Vulnerability Details **File Locations**: - `scripts/extract_chapters.py:126` - `scripts/extract_chapters.py:145-147` - `scripts/save_chapters.py:10-16` **Vulnerability Type**: Hard-coded sensitive local paths and unexpected local-file access **Risk Level**: Medium ### Vulnerable Code `scripts/extract_chapters.py:126`: ```python file_path = "/Users/chenkuan/Desktop/毕业论文/规模与杠杆对银行系统性风险的影响研究_王怡涵.txt" ``` `scripts/extract_chapters.py:145-147`: ```python with open('/Users/chenkuan/.openclaw/workspace/large-document-reader-1.0.0/chapters_info.json', 'w', encoding='utf-8') as f: import json json.dump(chapters, f, ensure_ascii=False, indent=2) ``` `scripts/save_chapters.py:10-16`: ```python # 读取章节信息 with open('chapters_info.json', 'r', encoding='utf-8') as f: chapters = json.load(f) # 读取原始文件 with open('/Users/chenkuan/Desktop/毕业论文/规模与杠杆对银行系统性风险的影响研究_王怡涵.txt', 'r', encoding='utf-8') as f: original_lines = f.readlines() ``` ### Technical Analysis Both scripts embed absolute paths tied to a specific user's home directory and personal document. When executed, the code attempts to read that document without obtaining an input path or explicit file selection from the current user. The extraction script additionally writes generated data to a fixed workspace path outside the current project directory. The file content is processed with the privileges of the account running the scripts. Therefore, any file accessible to that account at the hard-coded location may be read and transformed into generated artifacts. The embedded username and document title also disclose local environment and personal-document metadata. This behavior does not match the documented workflow, which presents the input as a document supplied by the user. It also makes the scripts non-portable and can cause data to be read from or written to an unintended location. ### Attack Path 1. An agent or user invokes `s ...[truncated 1365 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all absolute personal paths and document names from the source code. 2. Require input and output paths through explicit command-line arguments, such as `--input`, `--chapters-dir`, and `--metadata-output`. 3. Resolve and validate paths before access. Reject nonexistent inputs, non-regular files, unsupported extensions, and output paths outside a user-approved directory. 4. Require explicit user authorization before reading any file outside the current project workspace. 5. Default generated output to a project-relative directory and create it safely with `Path.mkdir(parents=True, exist_ok=True)`. 6. Avoid overwriting existing files unless the user supplies an explicit overwrite option. 7. Remove unused reads, including `original_lines` in `save_chapters.py`, if the original document is not required. 8. Avoid placing usernames, personal document titles, or other environment-specific metadata in committed source code. 9. Add error handling for permission failures, malformed JSON, invalid encodings, and unsafe output destinations. 10. Document the exact filesystem inputs and outputs so execution behavior matches the stated skill workflow. A safer interface would follow this pattern: ```python from argparse import ArgumentParser from pathlib import Path parser = ArgumentParser() parser.add_argument("--input", required=True, type=Path) parser.add_argument("--output-dir", required=True, type=Path) args = parser.parse_args() input_path = args.input.expanduser().resolve() output_dir = args.output_dir.expanduser().resolve() if not input_path.is_file(): raise ValueError("The input path must identify an existing regular file.") output_dir.mkdir(parents=True, exist_ok=True) ```