T09 · Insecure Skill Coding Practices
Error
- Location
hooks/on_complete.py:31- Finding
Predictable Shared Temporary Files Enable Symlink Attacks and PID Manipulation
- Content
View full analysis
> "$LOG_FILE"; } ``` `hooks/start_claude.sh`: ```bash MONITOR_PID_FILE="/tmp/claude_monitor_${SESSION}.pid" nohup bash "$SKILL_DIR/hooks/pane_monitor.sh" "$SESSION" > /dev/null 2>&1 & echo $! > "$MONITOR_PID_FILE" ``` `hooks/stop_claude.sh`: ```bash MONITOR_PID_FILE="/tmp/claude_monitor_${SESSION}.pid" # Stop pane monitor if [ -f "$MONITOR_PID_FILE" ]; then kill "$(cat "$MONITOR_PID_FILE")" 2>/dev/null || true rm -f "$MONITOR_PID_FILE" ``` ### Technical Analysis The Skill creates logs and PID files at predictable paths in the shared `/tmp` directory. These files are opened or overwritten without: - Atomic exclusive creation. - Symbolic-link rejection. - Ownership verification. - Restrictive file permissions. - Validation of PID-file contents and process identity. An attacker with local access can create the expected path before the Skill runs. If the path is a symbolic link, the Skill may append to or overwrite another file that the Skill user can modify. The completion hook makes this more consequential because it logs the working directory and up to 200 characters ...[truncated 1713 chars]- Remediation
View remediation
/cmdline` or an equivalent mechanism to confirm it is the expected pane monitor before signaling it. - Prefer process supervision or retain the child process handle rather than using a predictable PID file. 4. Reduce logged information: - Do not log Claude response content or absolute working directories by default. - Add an explicit debug mode for sensitive diagnostic logging. - Separate logs by session and apply mode `0600`. 5. Validate session names with a strict allowlist such as `^[A-Za-z0-9_-]+$` before using them in filenames or process matching. ]]>