T09 · Insecure Skill Coding Practices
- Location
scripts/init_project.sh:5- Finding
Unrestricted Project Path Allows Overwriting Existing Files
- Content
View full analysis
Vulnerability Details
File Location:
scripts/init_project.sh, lines 5-16 and subsequent file writes at lines 21-140
Vulnerability Type: Unvalidated filesystem path and destructive file overwrite
Risk Level: MediumVulnerable Code
bash PROJECT_NAME=$1 if [ -z "$PROJECT_NAME" ]; then echo "Usage: bash init_project.sh <project-name>" exit 1 fi echo "🚀 Initializing project: $PROJECT_NAME" # Create project directory mkdir -p "$PROJECT_NAME" cd "$PROJECT_NAME" # Create basic structure mkdir -p .github/workflows # Create index.html cat > index.html <<'EOF'The same unconditional redirection pattern is subsequently used for
styles.css,script.js,README.md, and.github/workflows/deploy.yml.Technical Analysis
The script accepts
PROJECT_NAMEas an arbitrary path. Although the variable is quoted, which prevents shell word splitting and ordinary command injection, it is not validated as a project name or constrained to an approved workspace.Values such as
.,.., an absolute path, or a path to an existing project are accepted bymkdir -pandcd. The script then uses truncating output redirection (>) to replace predictable files without checking whether the destination is new or whether those files already exist.This violates safe filesystem-boundary and fail-safe overwrite principles. The vulnerability is limited by the operating-system permissions of the user running the script; it does not independently provide privilege escalation.
Attack Path
- An attacker persuades the user or Agent to use a crafted “project name,” such as
.,../existing-project, or an absolute writable path. - The documented initialization command is executed with that value.
mkdir -psucceeds because the target already exists or can be created.cdchanges into the attacker-selected destination.- The script silently truncates a ...[truncated 635 chars]
- An attacker persuades the user or Agent to use a crafted “project name,” such as
- Remediation
View remediation
Remediation Suggestions
-
Validate project names against a restrictive allowlist, for example:
bash if [[ ! "$PROJECT_NAME" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then echo "Invalid project name" >&2 exit 1 fi -
Reject absolute paths, path separators,
.and... -
Resolve the canonical destination and verify that it remains beneath an explicitly approved workspace directory.
-
Abort if the destination already exists and is non-empty unless the user gives explicit overwrite confirmation.
-
Create the project atomically with plain
mkdirrather thanmkdir -p, so existing destinations cause failure. -
Use non-clobbering writes or temporary files followed by atomic renames.
-
Run the script as an unprivileged account and never with
sudo.
-