T09 · Insecure Skill Coding Practices
Error
- Location
scripts/output_generator.py:311- Finding
Arbitrary File Write Through Unvalidated Skill Name
- Content
View full analysis
Path: """Create a new skill file in the project's .claude/skills/ directory.""" ensure_directories() skill_dir = get_project_skills_dir() / skill_name skill_dir.mkdir(parents=True, exist_ok=True) skill_path = skill_dir / 'SKILL.md' skill_path.write_text(skill_content) return skill_path ``` ### Technical Analysis The `skill_name` argument is accepted directly from the `--create-skill` command-line option and joined to the intended `.claude/skills` directory without validation or containment checks. `pathlib.Path` does not prevent traversal components such as `..`. In addition, if `skill_name` is an absolute path, joining it to the base path discards the base path. Consequently, the resulting destination can escape the intended skills directory. The final filename is always `SKILL.md`, but an attacker can still select an arbitrary parent directory reachable by the current user and overwrite an existing `SKILL.md`. This is especially security-sensitive because such files may contain persistent Agent instructions. ### Attack Path 1. An attacker or untrusted automation gains the ability to control the `--create-skill` value and `--content`. 2. The attacker supplies a traversal or absolute path, for example: ```bash python scripts/output_generator.py \ --create-skill "../../../../tmp/attacker-controlled" \ --content "attacker-controlled skill instructions" ``` 3. `get_project_skills_dir() / skill_name` resolves outside `.claude/skills`. 4. The program creates the selected directory if necessary. 5. It writes attacker-controlled content to the resulting `SKILL.md`. 6. If the selected destination is an Agent-discovered skill ...[truncated 709 chars]- Remediation
View remediation