T09 · Insecure Skill Coding Practices
- Location
scripts/generate_image.js:115- Finding
Arbitrary Local File Overwrite Through Unrestricted Output Path
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate_image.js, lines 115-120
Vulnerability Type: Unrestricted file write and overwrite
Risk Level: MediumVulnerable Code:
javascript if (opts.filename) { const dir = path.dirname(opts.filename); if (dir && !fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true }); const imgRes = await fetch(imageUrl); const buf = Buffer.from(await imgRes.arrayBuffer()); fs.writeFileSync(opts.filename, buf);Technical Analysis
The
--filenameargument is used directly as a filesystem path without normalization, containment checks, an allowed output directory, or overwrite protection. The code also creates missing parent directories recursively. Consequently, an invocation can target any path writable by the operating-system account running the skill.fs.writeFileSync()overwrites an existing file by default. The downloaded response is written without validating the HTTP status, MIME type, or maximum response size. This can result in unexpected content being stored or excessive memory and disk consumption.Attack Path
- An attacker supplies task content that causes the agent or user to invoke the skill with an attacker-selected
--filenamevalue. - The value identifies a sensitive file writable by the skill process, potentially using an absolute path or path traversal.
- The script creates missing parent directories where permitted.
- It downloads the URL returned by the image-generation service into memory.
fs.writeFileSync()creates or overwrites the selected file without confirmation.- Subsequent applications may consume the corrupted or replaced file.
Impact Assessment
Exploitation does not grant privileges beyond those of the process running the skill. Within those privileges, it can overwrite user-owned configuration files, scripts, documents, or other writable resources. This may cause data loss ...[truncated 269 chars]
- An attacker supplies task content that causes the agent or user to invoke the skill with an attacker-selected
- Remediation
View remediation
Remediation Suggestions
- Store generated images only in a dedicated output directory with restrictive permissions.
- Resolve the requested path using
path.resolve()and verify that it remains beneath the approved directory. - Reject absolute paths, traversal components, symbolic-link escapes, and special files.
- Generate server-side filenames rather than accepting unrestricted paths.
- Use exclusive file creation, such as the
wxflag, unless overwrite is explicitly requested and confirmed. - Validate
imgRes.ok, enforce an allowlist of image MIME types, and reject redirects to untrusted schemes or destinations where appropriate. - Stream the response to disk while enforcing strict download and output-size limits instead of loading the entire response into memory.
- Write to a securely created temporary file and atomically rename it after validation.