T09 · Insecure Skill Coding Practices
Note
- Location
- SKILL.md:85
- Finding
- Predictable Shared Temporary File Enables Symlink-Based File Overwrite## Vulnerability Details **File Location**: `SKILL.md`, lines 85-94 **Vulnerability Type**: Unsafe temporary-file handling **Risk Level**: Low ### Vulnerable Code ```bash curl -s https://api.openai.com/v1/audio/speech \ -H "Authorization: Bearer $OPENAI_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "tts-1-hd", "input": "<news summary text>", "voice": "onyx", "speed": 0.95 }' \ --output /tmp/news.mp3 ``` ### Technical Analysis The voice-summary workflow writes generated audio to the fixed, predictable path `/tmp/news.mp3`. On systems where `/tmp` is shared among users or processes, an attacker may create this path in advance as a symbolic link to another file. When the documented `curl` command subsequently opens the output path, it may follow the symbolic link and truncate or overwrite the linked destination using the privileges of the process running the skill. The fixed filename also creates race conditions between concurrent skill executions and may expose one user's generated audio to another local user, depending on filesystem permissions and system configuration. The external HTTPS requests themselves are consistent with the skill's declared functionality. `$OPENAI_API_KEY` is sent only as an authorization credential to the declared OpenAI TTS endpoint; the reviewed content does not establish credential exfiltration. ### Attack Path 1. A local attacker capable of writing to `/tmp` predicts that the skill will use `/tmp/news.mp3`. 2. Before the voice-summary workflow runs, the attacker creates `/tmp/news.mp3` as a symbolic link to a file writable by the skill's operating-system account. 3. A user invokes the optional voice-summary workflow. 4. `curl` follows the attacker-controlled path while creating or truncating its output. 5. The OpenAI audio response overwrites the linked target with the privileges of the skill process. Alternatively, two co ...[truncated 561 chars]
- Remediation
- ## Remediation Suggestions - Create a private, unpredictable temporary directory and file rather than using a fixed shared path: ```bash tmp_dir="$(mktemp -d)" || exit 1 chmod 700 "$tmp_dir" audio_file="$tmp_dir/news.mp3" cleanup() { rm -rf -- "$tmp_dir" } trap cleanup EXIT HUP INT TERM curl --fail --silent --show-error \ https://api.openai.com/v1/audio/speech \ -H "Authorization: Bearer $OPENAI_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "tts-1-hd", "input": "<news summary text>", "voice": "onyx", "speed": 0.95 }' \ --output "$audio_file" ``` - Apply restrictive permissions with `umask 077` before creating temporary content. - Remove temporary audio immediately after it has been delivered. - Do not reuse output paths across users, sessions, or concurrent executions. - If the execution environment supports it, use an application-owned private temporary directory and APIs that create files atomically without following symbolic links.