T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:78- Finding
Receiver-Controlled Path Traversal Enables Arbitrary File Write and Recursive Deletion
- Content
View full analysis
"$RECV_DIR/$FILENAME" rm -rf "$RECV_DIR/$FILENAME.chunks" echo "Reassembled: $RECV_DIR/$FILENAME" ``` ### Technical Analysis The `filename` field is read directly from an inbox message and incorporated into filesystem paths without validation or canonicalization. Shell quoting prevents word splitting and wildcard expansion of the variable itself, but it does not prevent path traversal sequences such as `../`. The vulnerable value is used in three security-sensitive operations: 1. `mkdir -p` creates a chunk directory. 2. Output redirection writes the assembled file. 3. `rm -rf` recursively removes the derived chunk directory. The completion message independently supplies its own filename, and the code does not bind it to a previously validated transfer record. Consequently, an attacker who can deliver a crafted inbox message can select paths outside `$RECV_DIR`, subject to the receiving process's filesystem permissions. ### Attack Path 1. An attacker sends a `chunk_transfer_start` message whose `filename` contains traversal components, such as `../../target`. 2. The receiver evaluates: ```bash mkdir -p "$RECV_DIR/../../target.chunks" ``` creating a directory outside the intended receiving directory. 3. The attacker arranges for chunk files to be present in the selected chunk directory through ...[truncated 778 chars]- Remediation
View remediation