T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:90- Finding
Unrestricted Local File and URL Handling May Enable Unintended Data Transmission
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 90–106
Vulnerability Type: Unrestricted file-source handling and unsafe temporary-file workflow
Risk Level: MediumThe documented workflow accepts a user-provided image URL or local path, downloads or copies the resource into the platform workspace, and then transmits it to a user-supplied WhatsApp recipient:
text 用户提供图片 URL 或路径 + 联系人手机号 ↓ Step 1: 下载图片到 /tmp/ 目录 ↓ Step 2: 复制到工作区目录 ↓ Step 3: 调用发送命令（含说明文字） ↓ Step 4: 清理临时文件 ↓ 返回发送结果Concrete executable examples appear at lines 145–163:
bash # Step 1: 下载图片 curl -o /tmp/funny.jpg https://example.com/funny.jpg # ... # Step 2: 复制到工作区 cp /tmp/funny.jpg ~/.skill-platform/workspace/ # ... # Step 3: 发送到 WhatsApp message --channel whatsapp \ --target +8613800138000 \ --filePath ~/.skill-platform/workspace/funny.jpg \ --message "看到这张图觉得很有趣" # ... # Step 4: 清理临时文件 rm /tmp/funny.jpgLocal-file handling is demonstrated at lines 259–268:
bash # 直接复制到工作区 cp /path/to/local.png ~/.skill-platform/workspace/ # ... # 发送 message --channel whatsapp \ --target +14843124960 \ --filePath ~/.skill-platform/workspace/local.png \ --message "本地图片"Technical Analysis
The Skill declares support for JPG, PNG, and GIF files but does not specify or enforce:
- Canonical-path validation or an approved source-directory boundary.
- Rejection of symbolic links, device files, or other non-regular files.
- File-signature validation to confirm that content is genuinely an image.
- Maximum download or file-size limits.
- URL-scheme restrictions.
- Blocking of loopback, private, link-local, or cloud metadata addresses.
- Secure, uniquely generated temporary filenames.
- A final confirmation that identifies the canonical source and recipient before transmission.
Consequently, extension-based assumptions d ...[truncated 2105 chars]
- Remediation
View remediation
Remediation Suggestions
- Restrict local inputs to explicitly approved image directories and canonicalize every path before access.
- Verify that the canonical source remains inside the approved directory.
- Reject symbolic links, device nodes, FIFOs, sockets, and all non-regular files.
- Validate image magic bytes using a trusted image parser; do not rely only on filename extensions or response headers.
- Impose strict file-size, download-size, timeout, and redirect limits.
- Permit only HTTPS URLs. After every DNS resolution and redirect, reject loopback, private, link-local, multicast, reserved, and cloud metadata addresses.
- Create temporary files with secure random names and exclusive creation permissions, preferably inside a private per-run directory.
- Avoid fixed filenames under shared
/tmp; open and validate the created file safely before copying or transmitting it. - Quote and safely construct all command arguments when values originate from users.
- Require explicit confirmation immediately before sending, displaying the canonical source path or validated URL, verified media type, size, and full recipient number.
- Remove
callback_urlif it is unnecessary. If implemented, limit it to an approved HTTPS allowlist and apply the same SSRF protections. - Delete both temporary and workspace copies through a bounded cleanup routine that cannot operate outside the designated per-run directory.