T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/kai_tts.sh:17
- Finding
- Predictable Temporary Transcript Path Enables Local File and Symlink Manipulation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/kai_tts.sh`, lines 17–20 **Vulnerability Type**: Unsafe temporary-file handling and symlink vulnerability **Risk Level**: Medium ### Vulnerable Code ```bash whisper "$FILE" --model base --output_format txt --output_dir /tmp BASE=$(basename "$FILE" | sed 's/\.[^.]*$//') cp "/tmp/${BASE}.txt" "${WORKSPACE}/latest_from_blaze.txt" 2>/dev/null || true echo "Done" ``` ### Technical Analysis The script directs `whisper` to write its transcript into the shared `/tmp` directory. The expected output filename is derived predictably from the basename of user-supplied `FILE`. Because `/tmp` is normally writable by other local users, an attacker can anticipate `/tmp/${BASE}.txt` and create that path before the script executes. The path could be a regular file or a symbolic link. This creates a time-of-check/time-of-use and symlink-manipulation condition around both the `whisper` output and the subsequent `cp`. The fixed destination `${WORKSPACE}/latest_from_blaze.txt` can also be unsafe if an attacker with access to the workspace can replace it with a symbolic link before `cp` executes. ### Attack Path 1. The attacker determines or influences the basename of an audio file that the victim will transcribe. 2. The attacker predicts the transcript path, such as `/tmp/recording.txt`. 3. Before the victim invokes the skill, the attacker creates that path as attacker-controlled content or as a symbolic link. 4. The victim runs the script with `--transcribe`. 5. `whisper` and the subsequent `cp` operate on the attacker-controlled path. 6. Depending on filesystem permissions and the behavior of `whisper` and `cp`, attacker-selected content may be copied into the workspace, or a file accessible to the invoking account may be read or overwritten. ### Impact Assessment This flaw primarily affects transcript integrity and file confidentiality. A local attacker may substitute a forged transcript, cause the script to c ...[truncated 363 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Create a private temporary directory for every invocation: ```bash TMP_DIR=$(mktemp -d) trap 'rm -rf -- "$TMP_DIR"' EXIT ``` 2. Configure `whisper` to write only into that private directory rather than directly into `/tmp`. 3. Confirm that the generated transcript is a regular file and not a symbolic link before copying it. 4. Create the final output atomically, using a temporary file inside the trusted workspace followed by `mv`. 5. Ensure that the workspace is owned by the invoking user and is not writable by untrusted users. 6. Reject a final destination that already exists as a symbolic link. 7. Do not suppress all copy errors with `2>/dev/null || true`; fail securely and report the actual error. ]]>