T09 · Insecure Skill Coding Practices
Warning
- Location
references/cross-validation.md:18- Finding
Predictable Shared Temporary File Enables Cross-Agent Data Corruption and Unsafe File Writes
- Content
View full analysis
/tmp/research-cross-validate.txt << 'FINDINGS' ## My core findings (please review) 1. [Finding 1 — including specific data and sources] 2. [Finding 2] 3. [Finding 3] ... ## Key data points - [Data A]: [Value] (Source: [xxx]) - [Data B]: [Value] (Source: [xxx]) ## My main conclusion [Your analytical conclusion, 500–1000 words] FINDINGS ``` ```bash cat /tmp/research-cross-validate.txt | codex exec "You are an industry analyst. Review the following research findings..." 2>&1 cat /tmp/research-cross-validate.txt | gemini -p "You are an industry analyst. Review the following research findings..." 2>&1 cat /tmp/research-cross-validate.txt | claude -p "You are an industry analyst. Review the following research findings..." 2>&1 ``` ```bash rm -f /tmp/research-cross-validate.txt ``` The corresponding instructions in `SKILL.md` are: ```markdown 1. `exec`: Write core findings to `/tmp/research-cross-validate.txt` 2. `exec`: Invoke the recommended CLI, for example: `cat /tmp/research-cross-validate.txt | gemini -p "Review prompt..." 2>&1` ``` ### Technical Analysis The protocol assigns every research agent the same predictable path in the system-wide temporary directory. The Skill is explicitly designed to run several agents concurrently, making collisions expected rather than merely theoretical. An agent can overwrite another agent's findings between the write and read operations. One agent can also remove the shared file while another agent is still using it. This can cause findings from one research task to be disclosed to a different model invocation or incorporated into the wrong report. The initial shell redirection does not securely create the file ...[truncated 1955 chars]- Remediation
View remediation
"$findings_file" <<'FINDINGS' ... FINDINGS codex exec "Review prompt..." < "$findings_file" 2>&1 ``` Additional hardening measures: 1. Include the run ID and agent ID in logical filenames, while still relying on `mktemp` for unpredictability. 2. Never reuse one temporary path across concurrent agents. 3. Quote every generated path and use input redirection instead of `cat`. 4. Set `umask 077` before creating files containing research data. 5. Validate that the temporary directory is owned by the current account and is not a symbolic link. 6. Install cleanup with `trap` immediately after creating the directory so timeout and failure paths are covered. 7. Prefer an agent-private workspace or in-memory standard input when the CLI supports it. ]]>