T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:189- Finding
Predictable Shared Temporary Files Permit Symlink-Based File Overwrite
- Content
View full analysis
/tmp/ere_original.txt echo "$REFINED" > /tmp/ere_refined.txt # Analyze / analisar python3 scripts/ere.py analyze /tmp/ere_refined.txt python3 scripts/ere.py diff /tmp/ere_original.txt /tmp/ere_refined.txt ``` ### Technical Analysis The Skill instructs the agent to store user-provided text in two fixed paths under the globally shared `/tmp` directory. These paths are predictable and are opened through ordinary shell redirection, which follows symbolic links. A local attacker can create either path as a symbolic link to another file writable by the account running the agent. When the workflow executes, the redirection overwrites the symlink target with the original or refined text. The files are also not explicitly created with restrictive permissions and are not deleted after analysis. Depending on the process umask and host configuration, this can expose potentially sensitive submitted content to other local processes. Concurrent executions can also overwrite one another's data or analyze content from the wrong run. ### Attack Path 1. A local attacker determines that the ERE workflow uses `/tmp/ere_original.txt` and `/tmp/ere_refined.txt`. 2. The attacker creates one of these paths as a symbolic link to a file writable by the agent account: ```bash ln -s /path/to/agent-writable-file /tmp/ere_original.txt ``` 3. A user invokes ERE refinement with quantitative analysis. 4. The agent follows the documented command: ```bash echo "$ORIGINAL" > /tmp/ere_original.txt ``` 5. Shell redirection follows the symbolic link and overwrites the target with user-supplied text. 6. Alternatively, another local process can read, replace, or race the temporary files before the analysis commands execut ...[truncated 718 chars]- Remediation
View remediation
"$tmpdir/original.txt" printf '%s' "$REFINED" > "$tmpdir/refined.txt" python3 scripts/ere.py analyze "$tmpdir/refined.txt" python3 scripts/ere.py diff \ "$tmpdir/original.txt" \ "$tmpdir/refined.txt" ``` Additional hardening measures: 1. Use `printf '%s'` rather than `echo` so option-like text and escape sequences are not interpreted inconsistently. 2. Set a restrictive umask, such as `umask 077`, before creating files. 3. Keep all generated paths quoted. 4. Register cleanup before writing sensitive data. 5. Avoid retaining input after analysis unless the user explicitly requests persistence. 6. If implemented directly in Python, use `tempfile.TemporaryDirectory()` or securely opened files rather than constructing names manually. ]]>