T09 · Insecure Skill Coding Practices
- Location
SKILL.md:46- Finding
Predictable Temporary Paths Allow Local File Overwrite
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 46–72
Vulnerability Type: Unsafe temporary-file handling
Risk Level: MediumVulnerable Code
bash curl -sS https://robotaxitracker.com/ -o /tmp/robotaxi_home.htmlbash grep -o '/_next/static/chunks/[^"?]*\.js' /tmp/robotaxi_home.html | sort -u > /tmp/robotaxi_chunks.txt cat /tmp/robotaxi_chunks.txtbash mkdir -p /tmp/robotaxi_js while read -r u; do [ -n "$u" ] || continue f=$(basename "$u") curl -sS "https://robotaxitracker.com$u" -o "/tmp/robotaxi_js/$f" done < /tmp/robotaxi_chunks.txtbash rg -o '[A-Za-z0-9-]+\.convex\.cloud' -n /tmp/robotaxi_js/*.js | sort -u > /tmp/robotaxi_hosts.txt cat /tmp/robotaxi_hosts.txtTechnical Analysis
The documented workflow repeatedly writes to fixed, predictable paths in the shared
/tmpnamespace. It neither creates a private temporary directory securely nor validates the ownership and file type of existing paths.Shell output redirection and
curl -onormally follow symbolic links. On a multi-user system, a local attacker may pre-create/tmp/robotaxi_home.html,/tmp/robotaxi_chunks.txt,/tmp/robotaxi_hosts.txt, or files under/tmp/robotaxi_jsas symbolic links to other files writable by the account running the Agent. The subsequent workflow can then truncate or replace those link targets.Using
mkdir -p /tmp/robotaxi_jsdoes not mitigate this issue because an attacker may create that path before the workflow begins or influence entries beneath it. The downloaded bundle filename is reduced withbasename, which limits direct path traversal from the URL, but does not prevent attacks involving pre-created symbolic links at the resulting predictable destination.Attack Path
- A local attacker identifies that an Agent will invoke this Skill on a shared host.
- Before invocation, the attacker creates a symbolic link at a predictabl ...[truncated 1251 chars]
- Remediation
View remediation
Remediation Suggestions
Create a unique private temporary directory for every invocation, apply restrictive permissions, verify command success, and remove the directory when processing completes:
bash tmpdir=$(mktemp -d) || { echo "Failed to create a temporary directory" >&2 exit 1 } chmod 700 "$tmpdir" trap 'rm -rf -- "$tmpdir"' EXIT HUP INT TERM home_file="$tmpdir/robotaxi_home.html" chunks_file="$tmpdir/robotaxi_chunks.txt" hosts_file="$tmpdir/robotaxi_hosts.txt" js_dir="$tmpdir/js" mkdir -m 700 -- "$js_dir" || exit 1 curl --fail --silent --show-error \ https://robotaxitracker.com/ \ -o "$home_file" || exit 1Replace every fixed
/tmp/robotaxi_*reference with a path beneath$tmpdir. Additional hardening should include:- Abort if secure temporary-directory creation fails.
- Quote all path variables and use
--where supported. - Check the exit status of
curl, parsing commands, and file operations. - Avoid reusing temporary data across invocations.
- Do not operate with elevated OS privileges unless strictly necessary.
- Where supported, prevent following symbolic links or create output files atomically with exclusive-create semantics.