T09 · Insecure Skill Coding Practices
- Location
log_token.py:14- Finding
Token Data Is Read and Written Outside the Skill Directory
- Content
View full analysis
Vulnerability Details
File Location:
log_token.py:14-36,daily_report.py:13-24, andweekly_report.py:12-23
Vulnerability Type: Improper filesystem path construction and unsafe file handling
Risk Level: MediumVulnerable Code
log_token.py:14-24:python # Data file path DATA_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), '..', 'data') DATA_FILE = os.path.join(DATA_DIR, 'token_log.json') def ensure_data_file(): """Ensure the data file exists""" if not os.path.exists(DATA_DIR): os.makedirs(DATA_DIR) if not os.path.exists(DATA_FILE): with open(DATA_FILE, 'w', encoding='utf-8') as f: json.dump({}, f)log_token.py:34-36:python def save_data(data): """Save data to the file""" with open(DATA_FILE, 'w', encoding='utf-8') as f: json.dump(data, f, ensure_ascii=False, indent=2)daily_report.py:13-24:python # Data file path DATA_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), '..', 'data') DATA_FILE = os.path.join(DATA_DIR, 'token_log.json') def load_data(): """Load the data file""" if not os.path.exists(DATA_FILE): return {} try: with open(DATA_FILE, 'r', encoding='utf-8') as f: return json.load(f) except: return {}weekly_report.py:12-23:python # Data file path DATA_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), '..', 'data') DATA_FILE = os.path.join(DATA_DIR, 'token_log.json') def load_data(): """Load the data file""" if not os.path.exists(DATA_FILE): return {} try: with open(DATA_FILE, 'r', encoding='utf-8') as f: return json.load(f) except: return {}Technical Analysis
All three scripts are located in the project root. Appending
..to each script's directory therefore caus ...[truncated 2520 chars]- Remediation
View remediation
Remediation Suggestions
-
Store runtime data in an explicitly authorized directory inside the Skill or in a user-specific application-data directory:
python from pathlib import Path BASE_DIR = Path(__file__).resolve().parent DATA_DIR = BASE_DIR / "data" DATA_FILE = DATA_DIR / "token_log.json" -
If the intended package layout places scripts under
scripts/, move the Python files into that directory and place the JSON file under the project-leveldata/directory. Ensure the implementation and documentation describe the same layout. -
Resolve and validate the final path before access:
python resolved_dir = DATA_DIR.resolve() if BASE_DIR not in resolved_dir.parents and resolved_dir != BASE_DIR: raise RuntimeError("Data path escapes the authorized directory") -
Reject unexpected symbolic links where the deployment model permits them. On supported systems, use secure open flags such as
O_NOFOLLOW, and validate the opened file withfstat(). -
Write updates atomically by creating a temporary file in the same directory, flushing and synchronizing it, and then applying
os.replace(). -
Apply restrictive directory and file permissions, such as owner-only access where appropriate.
-
Use file locking when multiple logger processes can run concurrently, preventing lost updates and malformed JSON.
-
Replace broad exception handlers with specific handling for
json.JSONDecodeErrorandOSError. Report corruption instead of silently replacing the effective dataset with an empty dictionary.
-