T09 · Insecure Skill Coding Practices
- Location
SKILL.md:146- Finding
Predictable Shared Temporary Files May Expose Private Chat History
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 146–151 and 190–205
Vulnerability Type: Predictable and insecure temporary-file handling
Risk Level: MediumVulnerable code snippets:
bash # Lines 146–151 # Alternative using html2text: html2text "/path/to/My Activity/Gemini/My Activity.html" > /tmp/gemini.txt # Then search with grep grep -n "recommend|resign|quit" /tmp/gemini.txtpython # Lines 190–192 with open("/tmp/unified.jsonl", "w", encoding="utf-8") as f: for rec in records: f.write(json.dumps(normalize(rec), ensure_ascii=False) + "\n")bash # Lines 197–205 # Find resignation-related records across all platforms grep -E "resign|quit|change jobs" /tmp/unified.jsonl | head -20 # Distribution by platform jq -r '.source' /tmp/unified.jsonl | sort | uniq -c # Aggregate by month jq -r '.created_at[0:7]' /tmp/unified.jsonl | sort | uniq -cTechnical Analysis
The Skill recommends writing complete Gemini and cross-platform conversation exports to fixed filenames in the shared
/tmpdirectory. These exports can contain private conversations, account details, personal identifiers, financial data, business information, and other secrets.Fixed paths such as
/tmp/gemini.txtand/tmp/unified.jsonlprovide no isolation between users or concurrent executions. The examples do not establish a restrictiveumask, explicitly set file permissions, securely create the files, reject symbolic links, or guarantee deletion. Actual readability depends on the host's operating-system configuration and processumask, but the Skill does not enforce safe behavior.Predictable shell redirection may also follow a pre-existing symbolic link. If a local attacker can create the documented path before execution, the output could be redirected to another file that the victim process is permitted to overwrite. The Python
open(..., "w")call likewise follo ...[truncated 1866 chars]- Remediation
View remediation
Remediation Suggestions
-
Create a private temporary directory with a unique name and owner-only permissions:
bash umask 077 workdir="$(mktemp -d "${TMPDIR:-/tmp}/chat-export.XXXXXX")" || exit 1 trap 'rm -rf -- "$workdir"' EXIT HUP INT TERM html2text "/path/to/My Activity/Gemini/My Activity.html" \ > "$workdir/gemini.txt" -
Use Python's secure temporary-file APIs rather than a fixed path:
python import json import os import tempfile with tempfile.TemporaryDirectory(prefix="chat-export-") as workdir: output_path = os.path.join(workdir, "unified.jsonl") with open(output_path, "x", encoding="utf-8") as f: os.chmod(output_path, 0o600) for rec in records: f.write(json.dumps(normalize(rec), ensure_ascii=False) + "\n") # Analyze the file within this context. -
If results must persist, require a user-selected protected directory rather than a shared temporary directory. Create output files with mode
0600and directories with mode0700. -
Avoid following symbolic links. For security-sensitive low-level file creation, use exclusive creation and platform-appropriate flags such as
O_CREAT | O_EXCL | O_NOFOLLOWwhere supported. -
Add automatic cleanup and clearly warn that intermediate files contain plaintext conversation history. Securely control retained copies according to the storage medium and threat model.
-
Avoid displaying raw matching records by default. Redact email addresses, telephone numbers, government identifiers, payment-card data, credentials, and other secrets before producing reports or terminal output.
-