T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/kai_tts.sh:17- Finding
Predictable Temporary Transcript Path Enables Local File and Symlink Manipulation
- Content
View full analysis
/dev/null || true echo "Done" ``` ### Technical Analysis The script directs `whisper` to write its transcript into the shared `/tmp` directory. The expected output filename is derived predictably from the basename of user-supplied `FILE`. Because `/tmp` is normally writable by other local users, an attacker can anticipate `/tmp/${BASE}.txt` and create that path before the script executes. The path could be a regular file or a symbolic link. This creates a time-of-check/time-of-use and symlink-manipulation condition around both the `whisper` output and the subsequent `cp`. The fixed destination `${WORKSPACE}/latest_from_blaze.txt` can also be unsafe if an attacker with access to the workspace can replace it with a symbolic link before `cp` executes. ### Attack Path 1. The attacker determines or influences the basename of an audio file that the victim will transcribe. 2. The attacker predicts the transcript path, such as `/tmp/recording.txt`. 3. Before the victim invokes the skill, the attacker creates that path as attacker-controlled content or as a symbolic link. 4. The victim runs the script with `--transcribe`. 5. `whisper` and the subsequent `cp` operate on the attacker-controlled path. 6. Depending on filesystem permissions and the behavior of `whisper` and `cp`, attacker-selected content may be copied into the workspace, or a file accessible to the invoking account may be read or overwritten. ### Impact Assessment This flaw primarily affects transcript integrity and file confidentiality. A local attacker may substitute a forged transcript, cause the script to c ...[truncated 363 chars]- Remediation
View remediation
/dev/null || true`; fail securely and report the actual error. ]]>