T09 · Insecure Skill Coding Practices
- Location
scripts/tts_edge.py:39- Finding
Unrestricted Arbitrary File Deletion Through Cleanup Command
- Content
View full analysis
Vulnerability Details
File Location:
scripts/tts_edge.py, lines 39–49
Vulnerability Type: Unrestricted file deletion
Risk Level: HighVulnerable Code
python def cleanup(paths: list[str]) -> int: for p in paths: if not p: continue try: Path(p).unlink(missing_ok=True) except TypeError: path = Path(p) if path.exists(): path.unlink() return 0Technical Analysis
The
cleanupfunction accepts caller-controlled absolute or relative paths and passes them directly toPath.unlink()without validating their location, file type, ownership, or relationship to files generated by the skill.Although the documented workflow states that temporary outputs belong in the current caller workspace's
temp/directory, this restriction is not enforced. No canonical-path check ensures that a target remains beneath that directory. The function also does not restrict deletion to expected generated MP3 or VTT files.This creates an arbitrary-file deletion primitive limited only by the operating-system permissions of the account running the skill. The fallback branch has the same weakness.
Attack Path
- An attacker persuades the agent to invoke the documented cleanup subcommand with a path to an unrelated file, or otherwise controls a cleanup path.
- The command-line parser stores that path in
args.paths. main()invokescleanup(args.paths).- The function converts the supplied value to a
Pathwithout applying a directory boundary check. Path.unlink()deletes the target if the skill process has write permission.
Example:
bash python3 scripts/tts_edge.py cleanup /home/user/project/important-fileRelative traversal paths can likewise target files outside the intended temporary directory:
bash python3 scripts/tts_edge.py cleanup ./temp/../important-fileImpact Assessment
Successful exploitation can delete any ...[truncated 549 chars]
- Remediation
View remediation
Remediation Suggestions
- Determine an explicit trusted cleanup root, such as the resolved
temp/directory beneath the caller workspace. - Canonicalize the cleanup root and each requested target with
Path.resolve(). - Reject every target that is not a strict descendant of the trusted cleanup root.
- Reject symbolic links and non-regular files where appropriate.
- Restrict cleanup to files created by this skill, preferably by tracking generated paths rather than accepting arbitrary path arguments.
- Optionally enforce expected filename patterns and extensions such as
.mp3and.vtt; this should supplement, not replace, the directory-boundary check. - Fail closed with a clear error when validation fails.
- Add tests covering absolute paths,
..traversal, symlinks, sibling directories, and valid generated files.
A boundary check can follow this pattern:
python def cleanup(paths: list[str]) -> int: cleanup_root = (Path.cwd() / "temp").resolve() for value in paths: if not value: continue target = Path(value).resolve() try: target.relative_to(cleanup_root) except ValueError: raise ValueError(f"Refusing to delete path outside {cleanup_root}: {target}") if target.is_symlink() or (target.exists() and not target.is_file()): raise ValueError(f"Refusing to delete unsupported target: {target}") if target.suffix.lower() not in {".mp3", ".vtt"}: raise ValueError(f"Refusing to delete unexpected file type: {target}") target.unlink(missing_ok=True) return 0For stronger assurance, maintain a per-run allowlist of files successfully generated by the script and permit cleanup only for those recorded paths.
- Determine an explicit trusted cleanup root, such as the resolved