T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/security_scan_no_pii.sh:11
- Finding
- Predictable temporary file enables symlink-based file truncation## Vulnerability Details **File Location**: `scripts/security_scan_no_pii.sh:11-15` **Vulnerability Type**: Unsafe predictable temporary file **Risk Level**: Medium ### Vulnerable Code ```sh if grep -RInE "$PATTERN" $TARGETS >/tmp/book_capture_security_scan.txt 2>/dev/null; then echo "Security scan failed. Potential sensitive strings found:" cat /tmp/book_capture_security_scan.txt exit 1 fi ``` ### Technical Analysis The security scan writes its results to the fixed, predictable path `/tmp/book_capture_security_scan.txt`. On a multi-user system, another local user can create this path in advance as a symbolic link to another file. Shell output redirection is performed before `grep` executes. Consequently, the linked destination is opened and truncated even when `grep` ultimately finds no matches. The operation occurs with the privileges of the account running the security scan. The script does not use exclusive temporary-file creation, verify file ownership, reject symbolic links, or remove the file reliably after execution. ### Attack Path 1. An attacker with local access predicts the fixed temporary filename. 2. The attacker creates a symbolic link: ```sh ln -s /path/to/victim-writable-file /tmp/book_capture_security_scan.txt ``` 3. A user or agent runs: ```sh sh scripts/security_scan_no_pii.sh ``` 4. The shell follows the symbolic link while processing the output redirection. 5. The linked file is truncated and may subsequently receive scan output. Exploitation is limited to files writable by the account executing the Skill; this issue does not independently grant higher operating-system privileges. ### Impact Assessment A local attacker can cause arbitrary files writable by the Skill's execution account to be truncated or overwritten with scan output. This can lead to loss of user data, corruption of configuration files, or disruption of other applications. The iss ...[truncated 83 chars]
- Remediation
- ## Remediation Suggestions Create the temporary file atomically with `mktemp` and remove it through an exit trap: ```sh TMP_FILE="$(mktemp "${TMPDIR:-/tmp}/book_capture_security_scan.XXXXXX")" trap 'rm -f "$TMP_FILE"' EXIT HUP INT TERM if grep -RInE "$PATTERN" $TARGETS >"$TMP_FILE" 2>/dev/null; then echo "Security scan failed. Potential sensitive strings found:" cat "$TMP_FILE" exit 1 fi ``` Additional hardening measures: - Quote the temporary filename on every use. - Do not reuse a fixed path under a shared temporary directory. - Run the scan with the minimum required privileges. - Consider avoiding a temporary file entirely by capturing or piping the result safely.