T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:134
- Finding
- Predictable Shared Temporary Paths Permit File Collisions and Symlink Attacks## Vulnerability Details **File Location**: `SKILL.md:134-135`; `strategy-schema.md:274-276` **Vulnerability Type**: Predictable and shared temporary-file paths **Risk Level**: Medium **Relevant source excerpt from `SKILL.md:134-135` (English translation):** ```text 3. File paths use the original paths provided by the user; intermediate products use the `/tmp/ve_strategy/` prefix. 4. Steps in `execution_plan` must be serially executable; later steps may depend on the output of preceding steps. ``` **Relevant source excerpt from `strategy-schema.md:274-276` (English translation):** ```text - `execution_plan[].inputs` may use the `output` path of a preceding step. - Intermediate product paths uniformly use the `/tmp/ve_strategy/` prefix. - The final output path is written to `project.output_path`. ``` Examples throughout `examples.md`, including lines 222-326, 484-536, and 712-814, use predictable names such as: ```text /tmp/ve_strategy/merged_raw.mp4 /tmp/ve_strategy/with_text.mp4 /tmp/ve_strategy/clips/s1.mp4 ``` ### Technical Analysis The Skill requires generated execution plans to place intermediate media in a fixed, shared directory. It does not require a unique per-execution directory, restrictive directory permissions, exclusive file creation, ownership checks, or symbolic-link rejection. On systems where another user or process can write under `/tmp`, predictable names can be created before the downstream FFmpeg-related Skill runs. A pre-created path may be an attacker-controlled regular file or a symbolic link to another location. If the downstream tool follows symbolic links or overwrites existing files, it may read attacker-controlled content or overwrite a file selected by the attacker. Serial dependencies amplify this issue because subsequent steps trust prior output paths without requiring verification that the files were created by the current execution. Concurrent executions can also overwrite ...[truncated 1412 chars]
- Remediation
- ## Remediation Suggestions 1. Create a cryptographically unpredictable, per-execution temporary directory using the platform's secure temporary-directory API. 2. Set directory permissions to `0700` and verify that the current process owns the directory. 3. Generate unpredictable intermediate filenames instead of fixed names such as `merged_raw.mp4`. 4. Create outputs atomically and exclusively so existing paths cause failure rather than overwrite. 5. Refuse symbolic links and validate ownership and file type before every intermediate read or write. 6. Keep every generated intermediate path inside the canonicalized per-run directory and reject path traversal or directory escape. 7. Prevent one execution from accepting intermediate files created by another execution. 8. Clean up only the unique directory created by the current run; never recursively remove a shared fixed path. 9. Document these requirements in both `SKILL.md` and `strategy-schema.md` so downstream Skills enforce the same protections.