T09 · Insecure Skill Coding Practices
- Location
capability/pdf-analysis/SKILL.md:127- Finding
Predictable Shared Temporary Files in PDF Processing
- Content
View full analysis
Vulnerability Details
File Location:
capability/pdf-analysis/SKILL.md, lines 127, 188, and 228
Vulnerability Type: Predictable temporary-file creation
Risk Level: MediumVulnerable Code
python # Scanned PDF page img_path = f"/tmp/pdf_page_{i+1}.png" pix.save(img_path) # Hybrid PDF page img_path = f"/tmp/hybrid_page_{i+1}.png" pix.save(img_path) # Embedded PDF image img_path = f"/tmp/pdf_img_p{page_num+1}_{img_idx}.{ext}" with open(img_path, 'wb') as f: f.write(img_bytes)Technical Analysis
PDF pages and embedded images are written into the system-wide
/tmpdirectory using deterministic filenames derived only from page and image indexes. The workflow does not create a private per-run directory, generate unpredictable names, check whether an existing path is a symbolic link, enforce restrictive permissions, or delete generated files after processing.In a multi-user or concurrently executing environment, another process can predict these paths and pre-create files or symbolic links. Concurrent Skill invocations can also overwrite each other's files. The explicit
open(..., 'wb')operation used for embedded images follows symbolic links under normal filesystem semantics and truncates the destination before writing.Attack Path
- A local attacker determines that the Agent will process a PDF.
- The attacker predicts a path such as
/tmp/pdf_page_1.png,/tmp/hybrid_page_1.png, or/tmp/pdf_img_p1_0.png. - The attacker pre-creates the path as a file or, where filesystem permissions permit, as a symbolic link to another file writable by the Agent.
- The Agent processes the PDF and writes document-derived content to the attacker-controlled path.
- The attacker reads the extracted document image, corrupts the analysis through a race condition, or causes the linked destination to be overwritten.
- Because no cleanup is performed, sensitive page images may remai ...[truncated 511 chars]
- Remediation
View remediation
Remediation Suggestions
- Create a private directory for every processing operation with
tempfile.TemporaryDirectory(). - Generate files inside that directory with
tempfile.NamedTemporaryFile()or unpredictable UUID-based names. - Ensure temporary directories and files are accessible only to the Agent account, such as directory mode
0700and file mode0600. - Avoid reopening attacker-influenced paths. Where applicable, use exclusive creation and no-follow semantics.
- Pass the private temporary directory explicitly to rendering and extraction functions.
- Place cleanup in a context manager or
finallyblock so files are removed after success, failure, or timeout. - Do not reuse page-only names across users, documents, or concurrent executions.
- Create a private directory for every processing operation with