T09 · Insecure Skill Coding Practices
- Location
SKILL.md:216- Finding
Predictable Temporary File Exposes Betting Profile Data to Local Attacks
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 216–220
Vulnerability Type: Predictable and unsafe temporary-file handling
Risk Level: Mediumbash python3 -c \"<above script>\" > /tmp/agent_profile.json curl -s -X POST https://api.moltbook.com/v1/agents/profile \ -H "Authorization: Bearer $MOLTBOOK_API_KEY" \ -H "Content-Type: application/json" \ -d @/tmp/agent_profile.json | jq .Technical Analysis
The publishing instructions write sensitive betting-performance data to the fixed path
/tmp/agent_profile.json. Shared temporary directories are commonly writable by multiple local users and processes. A predictable filename creates several security risks:- A local attacker may pre-create the path as a symbolic link, potentially redirecting the write to another file writable by the Agent.
- The generated profile may be readable by other local users when the process has a permissive
umask. - Another process may replace or modify the file after generation but before
curlreads it, creating a time-of-check/time-of-use race. - The temporary file is not removed after publication, leaving financial-performance data on disk.
The profile includes betting volume, net profit, ROI, supported platforms, and activity dates. Although publishing these aggregates to Moltbook is an explicitly declared and user-triggered feature, retaining them in a predictable shared temporary file is unnecessary and exceeds the minimum local exposure required to perform the upload.
Attack Path
- An attacker with access to the same host monitors or anticipates use of the documented publishing command.
- The attacker creates
/tmp/agent_profile.jsonin advance, potentially as a symbolic link to another file that the Agent can overwrite. - The Agent runs the documented command and writes the generated betting profile through the attacker-controlled path.
- The attacker reads the generated ...[truncated 1192 chars]
- Remediation
View remediation
Remediation Suggestions
Avoid creating a temporary file by streaming the validated JSON directly to
curl:bash python3 -c \"<profile-generation-script>\" | curl --fail-with-body --silent --show-error \ -X POST https://api.moltbook.com/v1/agents/profile \ -H "Authorization: Bearer $MOLTBOOK_API_KEY" \ -H "Content-Type: application/json" \ --data-binary @-If an intermediate file is required:
- Set
umask 077before creating it. - Use
mktempto create a unique file atomically. - Validate the generated JSON before transmission.
- Keep the file descriptor and pathname under the same process's control.
- Install a shell trap that removes the file on normal exit, interruption, or failure.
- Use
curl --fail-with-body --silent --show-errorso server and transport failures are not silently ignored.
Example:
bash umask 077 profile_file="$(mktemp "${TMPDIR:-/tmp}/agent_profile.XXXXXX.json")" || exit 1 trap 'rm -f -- "$profile_file"' EXIT HUP INT TERM python3 -c \"<profile-generation-script>\" > "$profile_file" || exit 1 python3 -m json.tool "$profile_file" > /dev/null || exit 1 curl --fail-with-body --silent --show-error \ -X POST https://api.moltbook.com/v1/agents/profile \ -H "Authorization: Bearer $MOLTBOOK_API_KEY" \ -H "Content-Type: application/json" \ --data-binary @"$profile_file"Publishing should remain conditional on an explicit user request, and the user should be informed that betting volume, profit, ROI, platforms, and activity dates will be transmitted to Moltbook.
- Set