T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/generate_image.js:115
- Finding
- Arbitrary Local File Overwrite Through Unrestricted Output Path## Vulnerability Details **File Location**: `scripts/generate_image.js`, lines 115-120 **Vulnerability Type**: Unrestricted file write and overwrite **Risk Level**: Medium **Vulnerable Code**: ```javascript if (opts.filename) { const dir = path.dirname(opts.filename); if (dir && !fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true }); const imgRes = await fetch(imageUrl); const buf = Buffer.from(await imgRes.arrayBuffer()); fs.writeFileSync(opts.filename, buf); ``` ### Technical Analysis The `--filename` argument is used directly as a filesystem path without normalization, containment checks, an allowed output directory, or overwrite protection. The code also creates missing parent directories recursively. Consequently, an invocation can target any path writable by the operating-system account running the skill. `fs.writeFileSync()` overwrites an existing file by default. The downloaded response is written without validating the HTTP status, MIME type, or maximum response size. This can result in unexpected content being stored or excessive memory and disk consumption. ### Attack Path 1. An attacker supplies task content that causes the agent or user to invoke the skill with an attacker-selected `--filename` value. 2. The value identifies a sensitive file writable by the skill process, potentially using an absolute path or path traversal. 3. The script creates missing parent directories where permitted. 4. It downloads the URL returned by the image-generation service into memory. 5. `fs.writeFileSync()` creates or overwrites the selected file without confirmation. 6. Subsequent applications may consume the corrupted or replaced file. ### Impact Assessment Exploitation does not grant privileges beyond those of the process running the skill. Within those privileges, it can overwrite user-owned configuration files, scripts, documents, or other writable resources. This may cause data loss ...[truncated 269 chars]
- Remediation
- ## Remediation Suggestions - Store generated images only in a dedicated output directory with restrictive permissions. - Resolve the requested path using `path.resolve()` and verify that it remains beneath the approved directory. - Reject absolute paths, traversal components, symbolic-link escapes, and special files. - Generate server-side filenames rather than accepting unrestricted paths. - Use exclusive file creation, such as the `wx` flag, unless overwrite is explicitly requested and confirmed. - Validate `imgRes.ok`, enforce an allowlist of image MIME types, and reject redirects to untrusted schemes or destinations where appropriate. - Stream the response to disk while enforcing strict download and output-size limits instead of loading the entire response into memory. - Write to a securely created temporary file and atomically rename it after validation.