T09 · Insecure Skill Coding Practices
- Location
SKILL.md:65- Finding
Unsafe File Move Can Overwrite Existing Destination Files
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 65–66
Vulnerability Type: Unsafe file operation resulting in unintended overwrite
Risk Level: Mediumbash # Move file to category folder mv ~/Desktop/report.pdf ~/Documents/报告/Technical Analysis
The documented Unix
mvcommand moves the source into an existing directory without enabling no-clobber behavior or checking for a filename collision. If the destination directory already containsreport.pdf, standardmvbehavior can replace that file without prompting.This implementation conflicts with the Skill's stated no-overwrite guarantee, which promises automatic collision-safe renaming such as
filename_1.pdf. The document does not provide logic that checks destination existence, generates a unique filename, or preserves the prior destination file.Although the Skill proposes an operation log and rollback capability, recording the source and destination paths cannot recover the original contents of a destination file after those contents have been overwritten.
Attack Path
- The destination category directory already contains a file named
report.pdf. This may occur naturally or may be deliberately arranged by a local user able to write to that directory. - A different
report.pdfexists in the source directory. - The user approves the proposed organization operation.
- The agent follows the documented command:
bash mv ~/Desktop/report.pdf ~/Documents/报告/ - The existing destination file is replaced by the source file.
- A later rollback can move the new file back, but it cannot restore the overwritten destination file because its original contents were not preserved.
Impact Assessment
Successful exploitation or accidental triggering can cause irreversible loss of an existing destination file. The impact is limited to files writable under the permissions of the account executing the Skill; this issue does not independently provide pri ...[truncated 350 chars]
- The destination category directory already contains a file named
- Remediation
View remediation
Remediation Suggestions
Implement collision-safe moves rather than invoking plain
mv:- Resolve and validate the source and destination paths.
- Quote every path to prevent whitespace or shell metacharacters from changing command interpretation.
- Check whether the intended destination filename already exists.
- If a collision exists, generate a unique name such as
report_1.pdf, incrementing the suffix until an unused path is found. - Use no-clobber semantics such as
mv -n -- "$source" "$destination"as a final defense against race-related replacement. - Verify that the move succeeded before recording a
donestatus. - Record both the selected unique path and operation status in the rollback log.
- For stronger rollback guarantees, preserve destination files in a backup area before replacement; preferably, never replace them at all.
- Add tests covering duplicate filenames, hidden files, names with spaces, names beginning with hyphens, and concurrent destination creation.
A collision-safe shell pattern could use an existence loop followed by a no-clobber move:
bash source="$HOME/Desktop/report.pdf" directory="$HOME/Documents/报告" name="report" extension=".pdf" destination="$directory/$name$extension" counter=1 while [ -e "$destination" ]; do destination="$directory/${name}_${counter}${extension}" counter=$((counter + 1)) done mv -n -- "$source" "$destination"