T09 · Insecure Skill Coding Practices
- Location
SKILL.md:154- Finding
Unrestricted Local File Upload May Expose Sensitive Data to Discord
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 154–169
Vulnerability Type: Arbitrary local-file disclosure through an external upload channel
Risk Level: MediumVulnerable Code
markdown **With media attachment:** ```json { "action": "sendMessage", "to": "channel:123", "content": "Check out this audio!", "mediaUrl": "file:///tmp/audio.mp3" }touses formatchannel:<id>oruser:<id>for DMs (notchannelId!)mediaUrlsupports local files (file:///path/to/file) and remote URLs (https://...)- Optional
replyTowith a message ID to reply to a specific message
text The unrestricted local-path behavior is also declared at line 17: ```markdown - For media: `mediaUrl` with `file:///path` for local files or `https://...` for remote.Technical Analysis
The Skill instructs the agent to pass arbitrary
file:///pathvalues to the Discord tool. This allows the tool to read a local file using the permissions of the Clawdbot process and transmit its contents to a Discord channel or direct-message recipient.Local attachment support is consistent with the Skill's declared messaging functionality. However, allowing unrestricted filesystem paths exceeds the minimum privileges required for routine attachment handling. The instructions do not impose an allowlisted upload directory, canonical-path validation, symlink protection, sensitive-file filtering, or explicit confirmation of the source path and destination.
Consequently, a malicious prompt, untrusted Discord message, or user mistake could induce the agent to attach a readable sensitive file. The reviewed document does not itself select sensitive files or contain evidence of intentional exfiltration; the issue is an unsafe capability boundary.
Attack Path
- An attacker supplies content or a request instructing the agent to send a local file to a Discord channel or direct-messag ...[truncated 1412 chars]
- Remediation
View remediation
Remediation Suggestions
- Restrict local uploads to a dedicated, non-sensitive attachment directory rather than accepting arbitrary
file:///paths. - Canonicalize each requested path and verify that it remains beneath the approved directory.
- Reject path traversal, device files, symbolic links, and symlink-based escapes unless explicitly required and safely validated.
- Block known-sensitive filenames and locations, including environment files, credential stores, private keys, tokens, browser profiles, and Clawdbot configuration.
- Require explicit user confirmation before upload, displaying the canonical source path, file size, Discord destination, and whether the destination is a channel or direct message.
- Prefer opaque attachment handles for files deliberately provided by the user over direct filesystem paths.
- Run the Discord tool with minimal filesystem permissions and prevent it from reading secrets unrelated to messaging.
- Apply content-type and size validation before reading or transmitting a file.
- Record auditable metadata for local-file uploads without logging file contents or secrets.
- Update the Skill documentation to state that sensitive files must never be uploaded and that instructions originating from untrusted Discord content cannot authorize local-file disclosure.
- Restrict local uploads to a dedicated, non-sensitive attachment directory rather than accepting arbitrary