T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/search.sh:6
- Finding
- Unrestricted Output Path Allows Arbitrary File Overwrite in Search Script<![CDATA[ ## Vulnerability Details **File Location**: `scripts/search.sh`, lines 6-22 **Vulnerability Type**: Unrestricted file write and file truncation **Risk Level**: Medium ### Vulnerable Code ```bash MAX_RESULTS="${2:-5}" OUTPUT_FILE="${3:-search_results.json}" if [ -z "$QUERY" ]; then echo "Usage: search.sh <query> [max_results] [output_file]" exit 1 fi # 优先用 Tavily，其次 DuckDuckGo if [ -n "$TAVILY_API_KEY" ]; then curl -s "https://api.tavily.com/search" \ -H "Authorization: Bearer $TAVILY_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"query\": \"$QUERY\", \"max_results\": $MAX_RESULTS}" \ > "$OUTPUT_FILE" else # DuckDuckGo 免费 curl -s "https://api.duckduckgo.com/?q=$(echo "$QUERY" | urlencode)&format=json&no_html=1" \ > "$OUTPUT_FILE" fi ``` ### Technical Analysis The third positional argument is used directly as the destination of a shell redirection. Although the variable is quoted and therefore does not permit shell metacharacter injection, the script does not restrict the path to an approved output directory. Shell redirection opens the specified file with truncation before `curl` writes its response. Absolute paths, relative traversal paths such as `../../file`, and paths reached through symbolic links are accepted. Consequently, a caller that controls the script arguments can truncate or replace any file writable by the account running the Skill. ### Attack Path 1. An attacker supplies a research request or workflow input that influences the output-file argument. 2. The Agent invokes the script with a path outside the intended research directory, for example: ```bash ./scripts/search.sh "query" 5 "../../writable-configuration-file" ``` 3. The shell resolves the traversal path and opens the target using truncating redirection. 4. The target is emptied and then populated with the external API response, or left empty if the request produces no output. 5. Subsequent tools or sessions that depend on ...[truncated 638 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the caller-controlled output-path argument if it is not required. - Create a dedicated research-output directory and resolve all output files beneath it. - Reject absolute paths and path components containing `..`. - Canonicalize both the approved directory and requested destination, then verify that the destination remains inside the approved directory. - Reject symbolic-link destinations or open files using protections equivalent to `O_NOFOLLOW`. - Use restrictive permissions and atomic file creation. - Consider writing to a securely created temporary file and moving it into place only after a successful API response. - Return an error when the request fails instead of silently creating or truncating an output file. ]]>