T09 · Insecure Skill Coding Practices
- Location
references/flows/Fast/Fast1_Idea_Clarify.md:35- Finding
Unsanitized User-Controlled Project Names Permit Filesystem Path Traversal
- Content
View full analysis
Vulnerability Details
File Location:
references/flows/Fast/Fast1_Idea_Clarify.md, lines 35-39
Additional Locations:references/flows/Pro/Pro3_Outline_Planning.md, lines 8-10;references/flows/Ind/Ind0_Project_Initialize.md, lines 23-25
Vulnerability Type: Path traversal through unsafe path construction
Risk Level: HighVulnerable Instruction
The following is an English rendering of the complete vulnerable project-creation segment:
markdown ## 1.3 Create Project Create `./web-novels/{timestamp}-{novel name}/` Create a simplified `03-writing-plan.json`:Equivalent path construction is prescribed in the Professional and Industrial workflows:
text ./web-novels/{YYYYMMDD-HHmmss}-{novel name}/ ./web-novels/{YYYYMMDD-HHmmss}-{project name}/Technical Analysis
The workflow instructs the Agent to interpolate a novel or project name into a filesystem path. The name originates from user-provided story information, but the Skill does not require validation, canonicalization, path-separator removal, or a containment check before creating directories and writing project files.
Characters such as
/and\, as well as..path components, can change the meaning of the constructed path. A timestamp prefix does not prevent traversal because an attacker can place a separator after an arbitrary name component and then provide enough parent-directory components to escapeweb-novels.The issue applies to all three creation modes. Subsequent workflows trust the resulting project path when creating outlines, writing plans, chapter files, summaries, character databases, and release artifacts.
Attack Path
- An attacker requests creation of a novel and supplies a crafted title or project name such as
story/../../../target. - The Agent follows the documented path template and constructs a path resembling:
text ./web-novels/20260916-120000-story/../../../tar
...[truncated 1209 chars]
- An attacker requests creation of a novel and supplies a crafted title or project name such as
- Remediation
View remediation
Remediation Suggestions
- Treat every novel and project name as untrusted input.
- Generate a separate filesystem-safe identifier rather than using the display title directly.
- Apply a strict allowlist, such as Unicode letters, digits, spaces, hyphens, and underscores.
- Remove or reject
/,\, null bytes, control characters, drive prefixes, absolute-path prefixes, and.or..path components. - Impose a reasonable maximum filename length.
- Resolve the canonical output root and candidate path before any operation.
- Verify that the resolved candidate remains a descendant of the canonical
web-novelsdirectory. - Reject the operation if containment validation fails rather than silently modifying the name.
- Store the original display title only as metadata inside the project files.
- Apply the same validation to paths loaded from writing-plan JSON files because those files may be edited or corrupted.
- Require explicit user confirmation before writing anywhere outside the designated project root.
- Add tests covering traversal strings, absolute paths, Windows drive paths, mixed separators, encoded separators, and excessively long names.
A safe implementation should follow logic equivalent to:
python root = Path("web-novels").resolve() safe_name = sanitize_user_title(user_title) candidate = (root / f"{timestamp}-{safe_name}").resolve() if root not in candidate.parents: raise ValueError("Project path escapes the permitted output directory")