T09 · Insecure Skill Coding Practices
- Location
SKILL.md:215- Finding
Predictable Temporary File Enables Symlink-Based File Overwrite
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 215–220
Vulnerability Type: Unsafe temporary-file handling
Risk Level: MediumVulnerable Code:
bash cat > /tmp/test-for-bug.sh << 'EOF' #!/bin/sh npm test -- --grep "login should redirect" 2>/dev/null EOF chmod +x /tmp/test-for-bug.sh git bisect run /tmp/test-for-bug.shTechnical Analysis
The skill instructs the agent to create and overwrite a script at the fixed, predictable path
/tmp/test-for-bug.sh. On multi-user Unix-like systems,/tmpis generally shared and writable by unprivileged users.Shell output redirection follows symbolic links. If another local process creates
/tmp/test-for-bug.shas a symbolic link before these instructions are executed,cat > /tmp/test-for-bug.shmay overwrite the symlink target. The subsequentchmod +xmay also modify that target's permissions.No exclusive file creation, symlink validation, private temporary directory, restrictive initial permissions, or cleanup mechanism is used.
Attack Path
- A local attacker predicts the documented path
/tmp/test-for-bug.sh. - The attacker creates a symbolic link at that path pointing to a file writable by the account running the agent.
- The agent follows the skill and performs shell redirection to the predictable path.
- The operating system follows the symbolic link, causing the linked file to be overwritten with the test script.
- The documented
chmod +xcommand may additionally grant executable permissions to the target. - The resulting damage depends on which files the agent account can modify.
Impact Assessment
Successful exploitation can cause file corruption and unintended permission changes within the privileges of the account executing the skill. It does not independently provide privilege escalation: the target must already be writable by that account. However, overwriting a security-relevant user-controlle ...[truncated 294 chars]
- A local attacker predicts the documented path
- Remediation
View remediation
Remediation Suggestions
Replace the predictable shared path with a securely created private temporary directory, apply restrictive permissions, quote all path expansions, and guarantee cleanup:
bash tmpdir="$(mktemp -d)" || exit 1 chmod 700 "$tmpdir" || exit 1 trap 'rm -rf -- "$tmpdir"' EXIT HUP INT TERM script="$tmpdir/test-for-bug.sh" cat > "$script" <<'EOF' #!/bin/sh npm test -- --grep "login should redirect" 2>/dev/null EOF chmod 700 "$script" || exit 1 git bisect run "$script"Additional hardening measures:
- Do not reuse a fixed filename in a globally writable directory.
- Fail immediately if temporary-directory creation or permission assignment fails.
- Keep the script accessible only to the executing user.
- Remove temporary resources on normal completion and interruption.
- Where practical, create the test script inside a trusted project-controlled directory with validated ownership and permissions.