T09 · Insecure Skill Coding Practices
- Location
SKILL.md:160- Finding
Predictable Shared Temporary Files Permit Symlink Attacks
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 160–162
Vulnerability Type: Unsafe temporary-file handling
Risk Level: MediumVulnerable Code
bash curl -sL "https://media.tenor.com/详情见说明.gif" -o /tmp/g.gif && \ ffmpeg -i /tmp/g.gif -movflags faststart -pix_fmt yuv420p -vf "scale=trunc(iw/2)*2:trunc(ih/2)*2" /tmp/g.mp4 -y 2>/dev/null && \ cp /tmp/g.mp4 /root/.skill-platform/workspace/g.mp4Technical Analysis
The documented workflow uses the fixed, predictable paths
/tmp/g.gifand/tmp/g.mp4in a commonly shared temporary directory. It neither creates these files atomically nor verifies that they are regular files owned by the invoking user.Both
curl -oand FFmpeg with-yoverwrite their destinations. On systems where symbolic-link protections are absent or ineffective for the execution context, another local user can pre-create one of these paths as a symbolic link. The invoked utility may then follow that link and overwrite its target.The final destination under
/rootsuggests that the workflow may be run with elevated privileges. Running it as root would increase the seriousness of a successful temporary-file attack. This finding concerns the documented execution path; the project contains no executable implementation proving that the commands are automatically run as root.Attack Path
- An attacker with local access predicts that the Skill will use
/tmp/g.gifand/tmp/g.mp4. - Before invocation, the attacker creates one of those paths as a symbolic link to a file writable by the Skill's execution identity.
- A privileged or otherwise higher-authority agent runs the documented command sequence.
curlor FFmpeg follows the crafted path while overwriting its output.- The linked target is modified with downloaded or converted media data. Alternatively, an attacker able to replace
/tmp/g.mp4between conversion and copying may cause attacker-controlled content to be copied into the worksp ...[truncated 735 chars]
- An attacker with local access predicts that the Skill will use
- Remediation
View remediation
Remediation Suggestions
- Create a private temporary directory atomically instead of using fixed names:
bash tmp_dir="$(mktemp -d)" || exit 1 chmod 700 "$tmp_dir" trap 'rm -rf -- "$tmp_dir"' EXIT gif_file="$tmp_dir/input.gif" mp4_file="$tmp_dir/output.mp4" curl --fail --show-error --location \ "https://media.tenor.com/DETAILS.gif" \ --output "$gif_file" && ffmpeg -nostdin -i "$gif_file" \ -movflags faststart \ -pix_fmt yuv420p \ -vf "scale=trunc(iw/2)*2:trunc(ih/2)*2" \ "$mp4_file" && install -m 0600 -- "$mp4_file" /root/.skill-platform/workspace/g.mp4- Execute the conversion with a dedicated, unprivileged account. Avoid writing to
/root; use a workspace owned by that account. - Before consuming or copying an artifact, verify that it is a regular file, resides inside the private temporary directory, and is not a symbolic link.
- Avoid suppressing FFmpeg diagnostics during security-sensitive processing so failures remain visible.
- Apply resource limits and validate downloaded media before conversion to reduce exposure to malformed or excessively large files.
- If concurrent runs are expected, use a unique output name per invocation and publish the final artifact with an atomic rename inside the destination filesystem.