T09 · Insecure Skill Coding Practices
Error
- Location
scripts/prepare_java_maven_project.py:22- Finding
Arbitrary Recursive Directory Deletion Through Unrestricted Work Path
- Content
View full analysis
Path: if out_dir.exists(): shutil.rmtree(out_dir) out_dir.parent.mkdir(parents=True, exist_ok=True) subprocess.run(["git", "clone", repo_url, str(out_dir)], check=True) return out_dir ``` ```python work = Path(args.work).resolve() json_path = Path(args.json).resolve() ``` ### Technical Analysis The `--work` argument is resolved to an absolute path but is not constrained to an application-owned temporary directory. In Git mode, `clone_repo()` recursively deletes that path with `shutil.rmtree()` whenever it already exists. The implementation does not reject filesystem roots, parent directories, symbolic-link-derived destinations, or unrelated existing directories. The documentation describes the working directory as being under `temp`, but this requirement is not enforced in code. ### Attack Path 1. An attacker, unsafe wrapper, or operator supplies `--mode git`. 2. The `--work` argument is set to an existing valuable directory writable by the process. 3. `Path.resolve()` canonicalizes the supplied path without checking whether it is inside an approved temporary base. 4. `clone_repo()` detects that the directory exists. 5. `shutil.rmtree(out_dir)` recursively deletes its contents before Git cloning begins. 6. The deletion occurs even if the subsequent clone fails. For example, invoking the script with an existing application data directory as `--work` would cause that directory to be deleted before the repository is cloned. ### Impact Assessment Successful exploitation can delete arbitrary files and directories accessible to the executing account. The scope is bounded by operating-system permissions, but when the Skill runs under a broadly privileged user, the re ...[truncated 210 chars]- Remediation
View remediation