T09 · Insecure Skill Coding Practices
- Location
SKILL.md:178- Finding
Predictable Output Filename in a Shared Temporary Directory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 178-181
Vulnerability Type: Predictable and potentially unsafe temporary-file handling
Risk Level: MediumVulnerable Code Snippet
markdown ## Output Files - **Default**: write extracted JSON to `<system-temp>/<input-stem>.extracted.json` (e.g., `/tmp/invoice.extracted.json`). Use `tempfile.gettempdir()` for cross-platform code. - **Override**: if the user specifies an output path, use it. - **Always print the resolved absolute path** in your response so the user can locate the file.Technical Analysis
The skill instructs implementations to derive a deterministic filename from the input stem and place it directly in a shared system temporary directory. It does not require exclusive file creation, restrictive permissions, symlink checks, or an unpredictable filename.
On multi-user systems, an attacker who can write to the same temporary directory may predict the destination and create it before extraction begins. If the implementation follows symbolic links or opens the path with ordinary overwrite semantics, the attacker could redirect the write to another file accessible to the victim process. If permissions are permissive, another local user may also read extracted receipt or invoice data.
The instruction to print the resolved absolute path is not independently sufficient for exploitation, but it unnecessarily exposes storage-location details and may place sensitive path information into logs or conversation records.
Attack Path
- The attacker learns or predicts the source document stem, such as
invoice. - The attacker predicts the output as
/tmp/invoice.extracted.json. - Before extraction begins, the attacker creates that path as a symbolic link to another writable target or prepares it for later observation.
- The extraction implementation opens the predictable path without exclusive creation or symlink protection.
- Extracted document data is written t ...[truncated 710 chars]
- The attacker learns or predicts the source document stem, such as
- Remediation
View remediation
Remediation Suggestions
- Create temporary output using
tempfile.NamedTemporaryFile(delete=False)ortempfile.mkstemp()rather than constructing a predictable path withtempfile.gettempdir(). - Use an unpredictable suffix and exclusive atomic creation.
- Apply owner-only permissions, such as mode
0600, because extracted documents may contain sensitive business or personal data. - Do not follow symbolic links when opening output files. Where supported, use
O_NOFOLLOWtogether withO_CREAT | O_EXCL. - If a stable user-facing filename is required, create a private per-run directory with mode
0700, write securely inside it, and atomically rename the completed file after validating the destination. - Validate user-supplied output paths and require explicit confirmation before overwriting existing files.
- Avoid printing absolute paths unless necessary. When paths must be reported, ensure they are not sent to unrelated logs or external services.
- Document cleanup and retention behavior for extracted files.
- Create temporary output using