T09 · Insecure Skill Coding Practices
- Location
SKILL.md:16- Finding
Unrestricted and Destructive File Rewriting
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 16–23 and 31–36
Vulnerability Type: Unvalidated file access and destructive file mutation
Risk Level: MediumVulnerable Instructions
markdown ### compress 1. Analizează istoricul recent și datele din `<target>`. 2. Extrage informația esențială (Obiectiv, Status, Decizii, Knowledge, Next step). 3. Transformă în format NCM (Neural-Compressed Markdown) ultra-dens: - Tag-uri scurte: `[O]`, `[S]`, `[D]`, `[K]`, `[N]`. - Format: `[Tag]:valoare` sau `[Tag]:cheie:valoare`. - Elimină gramatica și zgomotul conversational. 4. Scrie în `<target>` și execută pruning pentru a menține fișierul la dimensiune minimă.markdown ### auto (Background Mode) 1. **Monitorizare:** Verifică periodic numărul de tokeni al sesiunii active. 2. **Trigger:** La atingerea unui prag (ex: 50k tokeni), declanșează automat `compress` pe fișierul de stare al proiectului. 3. **Pruning:** Identifică și elimină informațiile redundante sau expirate din fișierele de stare pentru a preveni creșterea dimensiunii fișierelor.Technical Analysis
The Skill accepts a caller-controlled
<target>path, reads the referenced file, and directs the agent to overwrite and prune that same file. It defines no path allowlist, dedicated state directory, extension restriction, canonical-path validation, symlink protection, backup, atomic replacement, or user confirmation.The background mode further directs the agent to trigger compression and deletion automatically. Because pruning is inherently lossy and the document provides no rollback or integrity mechanism, an incorrect target or an inaccurate assessment of “redundant” information can cause irreversible data loss.
This is an insecure Skill design rather than evidence of intentionally malicious code. The package contains no executable scripts, and the audited material does not demonstrate command execution or priv ...[truncated 1233 chars]
- Remediation
View remediation
Remediation Suggestions
- Restrict all reads and writes to a dedicated, explicitly configured state directory.
- Canonicalize the target path and reject absolute paths, traversal components, paths outside the approved root, and symbolic links.
- Permit only documented state-file extensions and reject unrelated project or system files.
- Write compressed output to a new temporary file in the same directory, validate it, and use an atomic rename only after successful completion.
- Preserve a versioned backup of the original file and provide a documented rollback procedure.
- Require explicit user confirmation before overwriting or pruning an existing file.
- Disable unattended destructive pruning by default. In background mode, generate a proposed output or diff and request approval before committing it.
- Apply file-size limits and verify that the selected file is a regular file owned or explicitly authorized by the user.
- Define deterministic retention rules rather than allowing unconstrained deletion based on subjective redundancy.
- Record the target, backup location, affected content categories, and operation result in an audit log without storing sensitive file contents.