T09 · Insecure Skill Coding Practices
- Location
scripts/setup.sh:25- Finding
Unconditional Overwrite of Parent-Directory Documentation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/setup.sh, lines 25-26
Vulnerability Type: Uncontrolled file overwrite and unsafe relative-path handling
Risk Level: MediumVulnerable Code
bash # 3. Create project-specific Best Practices and Model Router docs cp ./docs/BEST-PRACTICES.md ../docs/BEST-PRACTICES.md cp ./docs/MODEL-ROUTER.md ../docs/MODEL-ROUTER.mdTechnical Analysis
The setup script unconditionally copies two files into the parent directory without checking whether the destination files already exist. This differs from the preceding template-copy loop, which explicitly avoids replacing existing files.
Both source and destination paths are resolved relative to the caller's current working directory rather than the script's own directory. Consequently:
- Existing documentation in
../docs/is overwritten without confirmation or backup. - Running the script from an unexpected working directory can write into an unintended parent directory.
- If an attacker can control
./docs/in the working directory, attacker-controlled content can be copied into the parent project's documentation. - A destination symbolic link may cause
cpto overwrite the linked file, subject to the invoking user's permissions.
This is an insecure local file operation rather than privilege escalation. The script cannot write beyond the privileges already held by the invoking user.
Attack Path
- A victim has existing
docs/BEST-PRACTICES.mdordocs/MODEL-ROUTER.mdfiles in a parent project directory. - The victim invokes
scripts/setup.shfrom a directory containing the expected relativedocs/andtemplates/paths. - The script executes the unconditional
cpcommands. - Existing parent-project documentation is replaced without warning or backup.
In a shared or attacker-influenced workspace, an attacker could instead place crafted files under the working directory's
./docs/path ...[truncated 847 chars]- Existing documentation in
- Remediation
View remediation
Remediation Suggestions
Resolve paths from the script location and require an explicit target directory:
bash #!/usr/bin/env bash set -euo pipefail SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)" SOURCE_DOCS="$SCRIPT_DIR/../docs" TARGET_DIR="${1:?Usage: setup.sh TARGET_DIRECTORY}" mkdir -p -- "$TARGET_DIR/docs" for file in BEST-PRACTICES.md MODEL-ROUTER.md; do source="$SOURCE_DOCS/$file" destination="$TARGET_DIR/docs/$file" if [[ -e "$destination" || -L "$destination" ]]; then printf 'Refusing to overwrite existing destination: %s\n' "$destination" >&2 continue fi cp -- "$source" "$destination" doneAdditional hardening measures:
- Require explicit user confirmation before replacing existing files.
- Create backups when overwrite behavior is intentionally requested.
- Reject symbolic-link destinations with
[[ -L "$destination" ]]. - Validate that the resolved target remains inside the intended project directory.
- Use
set -euo pipefailso failed copies and unset variables terminate the script safely. - Document the exact destination scope and avoid relying on the caller's current working directory.