T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:175
- Finding
- Predictable Temporary Files Enable Symlink-Based File Overwrite and Data Exposure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 175 and 196–203 **Vulnerability Type**: Predictable temporary-file creation **Risk Level**: Medium ### Vulnerable Code ```javascript // const buf = Buffer.from(r.result.data, 'base64'); // require('fs').writeFileSync('/tmp/phone_screenshot.png', buf); ``` ```bash node tmp_phone_debug.js > /tmp/phone_out.txt 2>&1 cat /tmp/phone_out.txt ``` ```bash node tmp_phone_debug.js 1>/tmp/dbg.txt 2>/tmp/dbg_err.txt; echo "---stdout---"; cat /tmp/dbg.txt; echo "---stderr---"; cat /tmp/dbg_err.txt ``` ### Technical Analysis The instructions use fixed, predictable filenames in the shared `/tmp` directory. Both shell redirection and Node.js `writeFileSync()` normally follow symbolic links. A local attacker who can write to `/tmp` may therefore create one of these paths as a symbolic link before the instructions are run. When the invoking user subsequently writes debugging output or a screenshot, the operation can overwrite the symlink target with that user's permissions. The fixed filenames also create confidentiality risks: screenshots, console output, page data, URLs, error messages, or evaluated JavaScript results may remain accessible after debugging. Permissions for newly created shell output files depend on the user's `umask`, while a pre-existing file retains its existing ownership and permission characteristics. The behavior is not required for Android remote debugging. Secure, per-run temporary storage would provide the same functionality with less risk. ### Attack Path 1. An attacker with local access monitors or anticipates use of the documented debugging procedure. 2. The attacker creates a predictable path as a symbolic link, for example: ```bash ln -s /path/writable/by/victim /tmp/phone_out.txt ``` 3. The victim runs the documented command. 4. Shell redirection or `writeFileSync()` follows the symbolic link. 5. The target is truncated or overwritten using the victim's file ...[truncated 1024 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Create a private, unpredictable temporary directory for every debugging session and ensure it is accessible only to the current user: ```bash umask 077 debug_dir="$(mktemp -d "${TMPDIR:-/tmp}/phone-debug.XXXXXX")" || exit 1 trap 'rm -rf -- "$debug_dir"' EXIT HUP INT TERM node tmp_phone_debug.js >"$debug_dir/output.txt" 2>"$debug_dir/error.txt" cat -- "$debug_dir/output.txt" cat -- "$debug_dir/error.txt" ``` Pass the generated directory to Node.js rather than hardcoding `/tmp/phone_screenshot.png`. For files that must not already exist, open them with exclusive creation semantics, such as the Node.js `wx` flag: ```javascript const fs = require('fs'); const path = require('path'); const outputPath = path.join(process.env.DEBUG_DIR, 'phone_screenshot.png'); fs.writeFileSync(outputPath, buf, { flag: 'wx', mode: 0o600 }); ``` Additional hardening measures: - Do not run these debugging commands as root or another privileged account. - Avoid retaining browser data longer than necessary. - Validate that the temporary directory is owned by the current user. - Avoid following attacker-controlled symbolic links. - Document cleanup behavior and securely remove all generated artifacts after use. ]]>