T09 · Insecure Skill Coding Practices
- Location
templates/project.md:45- Finding
Unrestricted Project-Configured Paths Can Cause Unauthorized Local File Access
- Content
View full analysis
Vulnerability Details
File Location:
templates/project.md:45-53,claw.json:7,agents/compliance-advisor.md:23-25,agents/draft-writer.md:20-25
Vulnerability Type: Unvalidated filesystem paths and excessive filesystem permissions
Risk Level: MediumVulnerable Code
claw.json:7:json "permissions": ["file.read", "file.write", "file.search"],Faithful English translation of
templates/project.md:45-53:markdown > When any agent starts, it must read the following files in addition to its own configuration. Worldbuilding settings: [path] Character cards: [path] Outline or synopsis: [path] Style specification: [path] Compliance manual: [path, or "none"] Fact database: [path]Faithful English translation of
agents/compliance-advisor.md:23-25:markdown The following files must be read at startup: 1. project.md — obtain the target platform and compliance-manual path 2. [Compliance manual file] — use the path specified by project.mdFaithful English translation of
agents/draft-writer.md:20-25:markdown 1. project.md — obtain required-file paths and core restrictions 2. [Current chapter context package] 3. [Fact database] 4. [Style specification file] — path obtained from project.md 5. [Character-card file] — path obtained from project.md 6. [Complete story synopsis] — path obtained from project.mdTechnical Analysis
The Skill has global
file.read,file.write, andfile.searchpermissions. Its agent instructions require files referenced byproject.mdto be read, but no documented control validates or canonicalizes those paths.In particular, the implementation does not require configured paths to be relative to the declared project root, reject parent-directory traversal, reject absolute paths, resolve symbolic links safely, or ask for confirmation before accessing files outside the workspace. A malicious or untrusted ...[truncated 2321 chars]
- Remediation
View remediation
Remediation Suggestions
- Establish a canonical project root when the Skill starts and restrict all filesystem operations to that directory.
- Require configured file references to be relative paths. Reject absolute paths, URI-style paths, device paths, and paths containing traversal components.
- Resolve each requested path with a canonicalization function before access and verify that the resolved path remains beneath the canonical project root.
- Resolve and validate symbolic links to prevent an apparently internal path from escaping the workspace.
- Apply the same boundary checks to reads, searches, writes, file creation, and project-state updates.
- Split permissions by agent. Agents such as the compliance advisor should receive only
file.readand narrowly scoped search access; grantfile.writeonly to workflows that produce or update project artifacts. - Replace global filesystem permissions with workspace-scoped capabilities if the runtime supports them.
- Require explicit, informed user confirmation before accessing any exceptional path outside the project root. Display the canonical target path before access.
- Treat the contents of all project-referenced documents as untrusted data rather than executable instructions, preventing a loaded document from redefining agent behavior.
- Add tests covering absolute paths, parent traversal, nested traversal, symbolic-link escapes, malformed paths, and paths that differ only through normalization.